Disaster Recovery and Resiliency Specialist

• →Assists in developing and maintaining the IT resiliency strategy and multi-year roadmap.
• →Helps develop and maintain the University's IT backup and recovery standard, including requirements for backup immutability, isolation from production networks and credentials, encryption, retention, and recovery testing frequency.
• →Maintains the criticality tiers for University systems and the recovery time objectives (RTOs) and recovery point objectives (RPOs) assigned to each, working with system owners and the University's business continuity function on the business impact analysis.
• →Serves as ISO's point of contact for resiliency architecture, and reviews new systems and major changes for recoverability before they go into production.
• →Reviews requests for exceptions to the standard and recommends approval or denial to the CISO.
• →Develops and maintains the annual recovery testing and exercise program, prioritized by system criticality.
• →Plans, facilitates, and reports on technical recovery tests and tabletop exercises covering both conventional outages and cyber scenarios, including ransomware, destructive attacks, compromise of identity and privileged access systems, loss of a cloud region or major software-as-a-service provider, and a faulty vendor update affecting many systems at once.
• →Verifies backups can be restored within the required RTO and RPO, restored data is free of tampering or malware, and recovery does not reintroduce an attacker's access.
• →Coordinates joint exercises with the incident response team and with University leadership.
• →Tracks remediation of test findings to closure.
• →Helps ensure the incident response plan and recovery plans work together, including the decision points for isolating systems, declaring a disaster, and restoring from known-good copies.
• →Helps define the recovery order for foundational services such as identity, DNS, core network, privileged access, and the backup infrastructure itself, and plan for recovery when normal tools, accounts, and communication channels are unavailable.
• →Maintains offline copies of critical recovery documentation and out-of-band communication arrangements.
• →Coordinates recovery activities during major incidents and participates in post-incident reviews of how recovery performed.
• →Assesses current architecture against required RTOs and RPOs and records gaps in the ISO risk register with owners and target dates.
• →Maps the program to applicable frameworks and obligations, including the NIST Cybersecurity Framework 2.0 Recover function, NIST SP 800-34 contingency planning guidance, HIPAA contingency plan requirements for systems holding electronic protected health information, federal research security requirements, and cyber insurance requirements.
• →Prepares evidence for audits and compliance attestations.
• →Assesses the resiliency of cloud and third-party providers as part of ISO's third-party risk reviews and recommends contract terms.
• →Reports resiliency metrics, such as test coverage, the share of critical systems meeting their RTO, backup immutability coverage, and open findings, to the CISO quarterly as input to executive and Board reporting.
• →Keeps current on attacker techniques that target backups and recovery, and new recovery methods as University systems move to cloud and distributed platforms.
• →Uses a deep understanding of IT expertise to develop and implement security and compliance policies, guidelines, and safe practices for University-wide computing and networking systems.
• →Guides communications with users to understand their security needs and supports the implementation of procedures to accommodate them. Ensures that user community understands and adheres to necessary procedures to maintain security.
• →Performs other related work as needed.

• Bachelor's degree in information technology, computer science, information security, or a related field.

• At least five years of experience in disaster recovery, IT resiliency, or business continuity, in a planning, coordination, or administrative capacity.

• Hands-on experience with recovery technology, such as enterprise backup platforms (Commvault, NetBackup, Rubrik, Cohesity), immutable or isolated backup storage, replication and recovery orchestration tools (VMware Site Recovery Manager or equivalent), or cloud recovery services (AWS Elastic Disaster Recovery, AWS Backup, Azure Site Recovery).

• Planning and running recovery tests or tabletop exercises.

• Recovering from, or exercising for, a real cyber incident.

• Familiar with recovery of identity systems such as Active Directory and Microsoft Entra ID.

• Background in higher education, research, or another environment where IT is decentralized.

• Balancing the needs of multiple stakeholders and navigating complex policy, process, and people-related organizational dynamics.

• Contributing to and coordinating initiatives across teams, including during periods of change.

• Working knowledge of information security, including incident response, identity and access management, and common attack patterns such as ransomware.

• Familiarity with HIPAA, NIST SP 800-171, and the NIST Cybersecurity Framework.

• Builds trust through honesty, integrity, and collaborative working relationships.

• Strong written and verbal communication skills to explain the reasoning behind recommendations and interact effectively with all levels of the organization.

• Collaborates effectively with IT partners and supporting teams, and influences without direct authority to move work to completion.

• Anticipates and balances the needs of multiple stakeholders across IT Services and campus partners.

• Plans and prioritizes work to meet commitments aligned with organizational goals.

• Contributes to strategy development by identifying future risks and opportunities.

• Takes initiative on new challenges and follows through with a sense of urgency.

• Works effectively in ambiguous situations where the path forward is not yet clear.

• Navigates complex policies, processes, and organizational dynamics to keep work moving.

• Values differences and encourages open dialogue and inclusive collaboration.

• Hybrid work schedule, onsite and remote as determined by business needs. 

• Participation in on-call and incident response rotations, including after-hours work during major incidents and scheduled exercises.

• Resume/CV (required)  

• Cover Letter (required)  

• References Contact Information (3)(required)   

​
FLSA Status

​
Pay Range

The included pay rate or range represents the University’s good faith estimate of the possible compensation offer for this role at the time of posting.

The University of Chicago is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, sexual orientation, gender, gender identity, or expression, national or ethnic origin, shared ancestry, age, status as an individual with a disability, military or veteran status, genetic information, or other protected classes under the law. For additional information please see the University's Notice of Nondiscrimination.

Job seekers in need of a reasonable accommodation to complete the application process should call 773-702-5800 or submit a request via Applicant Inquiry Form.

All offers of employment are contingent upon a background check that includes a review of conviction history.  A conviction does not automatically preclude University employment.  Rather, the University considers conviction information on a case-by-case basis and assesses the nature of the offense, the circumstances surrounding it, the proximity in time of the conviction, and its relevance to the position.

The University of Chicago's Annual Security & Fire Safety Report (Report) provides information about University offices and programs that provide safety support, crime and fire statistics, emergency response and communications plans, and other policies and information. The Report can be accessed online at: http://securityreport.uchicago.edu. Paper copies of the Report are available, upon request, from the University of Chicago Police Department, 850 E. 61st Street, Chicago, IL 60637.