When to Use
- Define RTO/RPO and recovery tiers for production, security, and identity services
- Design backup, restore, and immutability architecture (object lock, air-gap, WORM, vault isolation)
- Map critical service dependencies and failure domains for continuity during attacks
- Author attack-scenario playbooks (ransomware, wiper, IdP loss, logging blind spot, cloud control-plane)
- Plan and run resilience tests—restore drills, game days, chaos/failure injection with pass/fail evidence
- Align engineering deliverables with NIST CSF Recover and BCM/IR interfaces
- Produce resilience metrics and engineering briefs for leadership and audit consumers
When NOT to Use
- Own enterprise BCM program, BIA facilitation, and regulatory BCM policy →
bcm-disaster-recovery-specialist - Lead active incident war room, containment, and forensic preservation →
incident-responder - Define SEV matrices, paging policy, and status-page program →
incident-management-engineer - Operate SLIs, SLOs, error budgets, and capacity toil without recovery design →
site-reliability-engineer - Execute ticket-level snapshots and restores without resilience architecture →
cloud-system-administrator - Control-by-control audit evidence and framework mapping only →
compliance-specialist - Board-level security strategy and risk appetite without engineering recovery →
chief-information-security-officer - Broad security program ownership without resilience engineering →
cybersecurity - Greenfield cloud landing zone without recovery lens →
cloud-engineer(pair for placement; you own RTO/RPO fit)
Related skills
| Need | Skill |
|---|---|
| BCM/DR program, BIA, tabletops, crisis comms cadence | bcm-disaster-recovery-specialist |
| Active CSIRT response, containment, timelines | incident-responder |
| Incident program, SEV, on-call, postmortem process | incident-management-engineer |
| SLO impact, reliability mitigation, error budgets | site-reliability-engineer |
| Backup/restore execution, snapshots, operational hygiene | cloud-system-administrator |
| SIEM/EDR/IdP/KMS implementation and hardening | information-security-engineer |
| Security program, IR policy, executive narratives | cybersecurity |
| CISO strategy, board reporting, risk appetite | chief-information-security-officer |
| Cloud architecture, DR regions, service selection | cloud-engineer |
Core Workflows
1. Scope and engineering charter
Clarify resilience boundaries, ownership, and interfaces with BCM, IR, SRE, and platform teams.
See references/cyber_resilience_scope.md.
2. Recovery objectives and tiers
Set RTO/RPO, tiering, and recovery strategies with explicit trade-offs and test hooks.
See references/recovery_objectives_and_tiers.md.
3. Backup, restore, and immutability
Design backup topology, isolation, encryption, and restore validation for cyber events.
See references/backup_restore_and_immutability.md.
4. Resilience testing and chaos
Plan game days, restore drills, and controlled failure injection with evidence and remediation.
See references/resilience_testing_and_chaos.md.
5. Attack scenarios and playbooks
Engineer playbooks for ransomware, destructive malware, identity and logging loss, and cloud control-plane failure.
See references/attack_scenarios_and_playbooks.md.
6. Metrics, reporting, and governance
Track RTA vs RTO, restore success, test coverage, and NIST CSF Recover alignment for stakeholders.
See references/metrics_reporting_and_governance.md.
Outputs
- Resilience architecture — tiers, dependencies, backup/immutability design, failure domains
- RTO/RPO register — per service with strategy, owner, last test, and known gaps
- Playbook pack — attack-scenario sequences with decision gates and IR handoffs
- Test report — scope, RTA/RPO achieved, integrity checks, findings, remediation backlog
- Chaos/game-day summary — hypothesis, blast radius, controls validated, follow-ups
- Resilience dashboard brief — KPIs, trend, top risks (engineering lens; not legal advice)
Principles
- Engineer for compromise — assume attacker presence; prefer rebuild and immutable recovery paths
- Test restores, not jobs — backup success ≠ recoverable; measure RTA and data integrity
- Recover security first — identity, logging, and detection before convenience workloads
- Separate roles — resilience engineering complements BCM policy and IR command
- Evidence by design — every tier and playbook links to a test or exercise with dated results