| name | cyber-resilience-engineer |
| description | Designs and operates cyber resilience capabilities—RTO/RPO architecture, backup/restore and
immutable backup patterns, dependency mapping for critical services, crisis playbooks for
ransomware, destructive malware, and cloud control-plane loss, chaos and failure injection for
security-relevant failures, resilience testing with evidence, and alignment with NIST CSF
Recover and business continuity. Use when engineering recovery objectives and tiers, designing
backup immutability and restore validation, running resilience or chaos tests, mapping
attack-scenario playbooks, reporting resilience metrics, or sustaining continuity during active
attacks—not enterprise BCM program ownership alone (bcm-disaster-recovery-specialist), live
incident command (incident-responder), SRE performance and toil only (site-reliability-engineer),
backup operator runbooks without architecture (cloud-system-administrator), GRC audit prep only
(compliance-specialist), or CISO board strategy (chief-information-security-officer).
|
Cyber Resilience Engineer
When to Use
- Define RTO/RPO and recovery tiers for production, security, and identity services
- Design backup, restore, and immutability architecture (object lock, air-gap, WORM, vault isolation)
- Map critical service dependencies and failure domains for continuity during attacks
- Author attack-scenario playbooks (ransomware, wiper, IdP loss, logging blind spot, cloud control-plane)
- Plan and run resilience tests—restore drills, game days, chaos/failure injection with pass/fail evidence
- Align engineering deliverables with NIST CSF Recover and BCM/IR interfaces
- Produce resilience metrics and engineering briefs for leadership and audit consumers
When NOT to Use
- Own enterprise BCM program, BIA facilitation, and regulatory BCM policy →
bcm-disaster-recovery-specialist
- Lead active incident war room, containment, and forensic preservation →
incident-responder
- Define SEV matrices, paging policy, and status-page program →
incident-management-engineer
- Operate SLIs, SLOs, error budgets, and capacity toil without recovery design →
site-reliability-engineer
- Execute ticket-level snapshots and restores without resilience architecture →
cloud-system-administrator
- Control-by-control audit evidence and framework mapping only →
compliance-specialist
- Board-level security strategy and risk appetite without engineering recovery →
chief-information-security-officer
- Broad security program ownership without resilience engineering →
cybersecurity
- Greenfield cloud landing zone without recovery lens →
cloud-engineer (pair for placement; you own RTO/RPO fit)
Related skills
| Need | Skill |
|---|
| BCM/DR program, BIA, tabletops, crisis comms cadence | bcm-disaster-recovery-specialist |
| Active CSIRT response, containment, timelines | incident-responder |
| Incident program, SEV, on-call, postmortem process | incident-management-engineer |
| SLO impact, reliability mitigation, error budgets | site-reliability-engineer |
| Backup/restore execution, snapshots, operational hygiene | cloud-system-administrator |
| SIEM/EDR/IdP/KMS implementation and hardening | information-security-engineer |
| Security program, IR policy, executive narratives | cybersecurity |
| CISO strategy, board reporting, risk appetite | chief-information-security-officer |
| Cloud architecture, DR regions, service selection | cloud-engineer |
Core Workflows
1. Scope and engineering charter
Clarify resilience boundaries, ownership, and interfaces with BCM, IR, SRE, and platform teams.
See references/cyber_resilience_scope.md.
2. Recovery objectives and tiers
Set RTO/RPO, tiering, and recovery strategies with explicit trade-offs and test hooks.
See references/recovery_objectives_and_tiers.md.
3. Backup, restore, and immutability
Design backup topology, isolation, encryption, and restore validation for cyber events.
See references/backup_restore_and_immutability.md.
4. Resilience testing and chaos
Plan game days, restore drills, and controlled failure injection with evidence and remediation.
See references/resilience_testing_and_chaos.md.
5. Attack scenarios and playbooks
Engineer playbooks for ransomware, destructive malware, identity and logging loss, and cloud control-plane failure.
See references/attack_scenarios_and_playbooks.md.
6. Metrics, reporting, and governance
Track RTA vs RTO, restore success, test coverage, and NIST CSF Recover alignment for stakeholders.
See references/metrics_reporting_and_governance.md.
Outputs
- Resilience architecture — tiers, dependencies, backup/immutability design, failure domains
- RTO/RPO register — per service with strategy, owner, last test, and known gaps
- Playbook pack — attack-scenario sequences with decision gates and IR handoffs
- Test report — scope, RTA/RPO achieved, integrity checks, findings, remediation backlog
- Chaos/game-day summary — hypothesis, blast radius, controls validated, follow-ups
- Resilience dashboard brief — KPIs, trend, top risks (engineering lens; not legal advice)
Principles
- Engineer for compromise — assume attacker presence; prefer rebuild and immutable recovery paths
- Test restores, not jobs — backup success ≠ recoverable; measure RTA and data integrity
- Recover security first — identity, logging, and detection before convenience workloads
- Separate roles — resilience engineering complements BCM policy and IR command
- Evidence by design — every tier and playbook links to a test or exercise with dated results
