Disaster Recovery and Resiliency Specialist

University of Chicago•Chicago, IL

6d•$125,000 - $135,000•Hybrid

About The Position

The Disaster Recovery and Resiliency Specialist supports the University of Chicago’s technology resiliency program within the Information Security Office. The role helps ensure the University can recover critical systems and data after cyberattacks, conventional outages, facility events, and failures at cloud or software vendors. Working independently with minimal guidance, the specialist helps develop resiliency strategy and recovery requirements, coordinates testing, tracks gaps to closure, and reports recovery risk to the CISO and University leadership. ITS service owners remain responsible for operating recovery solutions for their systems; this role supports the standard and coordinates testing against it. The specialist works with campus partners, the University of Chicago Medical Center, UChicago Global, emergency management, business continuity functions, and others to understand recovery needs and coordinate shared infrastructure and risks. The role also serves as a resource to colleagues on recovery practices, contributes security and compliance guidance for University-wide computing and networking systems, and helps users understand and follow security procedures. The position has a hybrid work schedule, onsite and remote as determined by business needs. Participation in on-call and incident response rotations is required, including after-hours work during major incidents and scheduled exercises. The role is an individual-contributor position with a scheduled 37.5-hour workweek. The posted salary range is $125,000–$135,000, and the position is benefits eligible.

Requirements

College or university degree in a related field.
Knowledge and skills developed through 5–7 years of work experience in a related job discipline.
Working knowledge of information security, including incident response, identity and access management, and common attack patterns such as ransomware.
Strong written and verbal communication skills to explain recommendations and interact effectively across organizational levels.
Ability to collaborate with IT partners and supporting teams and influence without direct authority.
Ability to anticipate and balance the needs of multiple stakeholders, plan and prioritize work, take initiative, and follow through.
Ability to work effectively in ambiguous situations and navigate complex policies, processes, and organizational dynamics.
Ability to value differences and encourage open dialogue and inclusive collaboration.

Nice To Haves

Bachelor's degree in information technology, computer science, information security, or a related field.
At least five years of experience in disaster recovery, IT resiliency, or business continuity in a planning, coordination, or administrative capacity.
Hands-on experience with enterprise backup platforms such as Commvault, NetBackup, Rubrik, or Cohesity; immutable or isolated backup storage; replication and recovery orchestration tools such as VMware Site Recovery Manager or equivalent; or cloud recovery services such as AWS Elastic Disaster Recovery, AWS Backup, or Azure Site Recovery.
Experience planning and running recovery tests or tabletop exercises.
Experience recovering from or exercising for a real cyber incident.
Familiarity with recovery of identity systems such as Active Directory and Microsoft Entra ID.
Background in higher education, research, or another environment with decentralized IT.
Experience balancing stakeholder needs and navigating complex policy, process, and organizational dynamics.
Experience contributing to and coordinating initiatives across teams, including during periods of change.
Familiarity with HIPAA, NIST SP 800-171, and the NIST Cybersecurity Framework.

Responsibilities

Assist in developing and maintaining the IT resiliency strategy and multi-year roadmap.
Help develop and maintain the University's IT backup and recovery standard, including requirements for backup immutability, isolation from production networks and credentials, encryption, retention, and recovery testing frequency.
Maintain criticality tiers for University systems and their recovery time objectives (RTOs) and recovery point objectives (RPOs), working with system owners and the University's business continuity function on business impact analysis.
Serve as the Information Security Office's point of contact for resiliency architecture and review new systems and major changes for recoverability before production.
Review requests for exceptions to the recovery standard and recommend approval or denial to the CISO.
Develop and maintain the annual recovery testing and exercise program, prioritized by system criticality.
Plan, facilitate, and report on technical recovery tests and tabletop exercises covering conventional outages and cyber scenarios.
Verify backups can be restored within required RTOs and RPOs, restored data is free of tampering or malware, and recovery does not restore an attacker's access.
Coordinate joint exercises with the incident response team and University leadership, and track remediation of test findings to closure.
Help ensure incident response and recovery plans work together, including decisions about system isolation, disaster declarations, and restoration from known-good copies.
Help define recovery order for foundational services and plan for recovery when normal tools, accounts, or communication channels are unavailable.
Maintain offline copies of critical recovery documentation and out-of-band communication arrangements.
Coordinate recovery activities during major incidents and participate in post-incident reviews.
Assess architecture against required RTOs and RPOs and record gaps in the Information Security Office risk register with owners and target dates.
Map the program to applicable frameworks and obligations, including NIST Cybersecurity Framework 2.0 Recover, NIST SP 800-34, HIPAA contingency-plan requirements for systems holding electronic protected health information, federal research security requirements, and cyber insurance requirements.
Prepare evidence for audits and compliance attestations.
Assess cloud and third-party provider resiliency as part of third-party risk reviews and recommend contract terms.
Report resiliency metrics quarterly to the CISO as input to executive and Board reporting.
Keep current on attacker techniques targeting backups and recovery, and on recovery methods for cloud and distributed platforms.
Use IT expertise to develop and implement security and compliance policies, guidelines, and safe practices for University-wide computing and networking systems.
Guide communications with users to understand security needs and support implementation of procedures; ensure the user community understands and follows necessary procedures.
Perform other related work as needed.