Department
OPS ITS - Architecture, Integration and Security
About the Department
IT Services (ITS) collaborates with campus partners to support the mission of the University of Chicago through the consistent delivery of high-quality solutions and services. We provide secure, stable, and reliable infrastructure and applications that support the mission of the University. ITS supports and enables faculty research and teaching with the effective use of technology, simplifies the technology experience for all users, identifies, manages, and mitigates technology risks for the University.
Job Summary
The Disaster Recovery and Resiliency Specialist supports the University's technology resiliency program within the Information Security Office, helping ensure the University can recover its critical systems and data after a serious disruption such as cyberattacks such as ransomware, destructive attacks, and compromise of identity systems, as well as conventional outages, facility events, and failures at cloud and software vendors. Working independently with minimal guidance, the Disaster Recovery and Resiliency Specialist assists in developing the resiliency strategy and recovery requirements, coordinates testing to verify that ITS and campus teams can meet them, and helps report recovery risk to the CISO and University leadership. ITS service owners continue to own and operate the recovery solutions for their systems. This role supports the standard, coordinates testing against it, and tracks gaps to closure.
The Disaster Recovery and Resiliency Specialist also works with the campus community, University of Chicago Medical Center, UChicago Global, the University's emergency management and business continuity functions, and others to understand their recovery needs and to coordinate on shared infrastructure and shared risks. This role also serves as a resource to colleagues on recovery practices.
Responsibilities
- Assists in developing and maintaining the IT resiliency strategy and multi-year roadmap.
- Helps develop and maintain the University's IT backup and recovery standard, including requirements for backup immutability, isolation from production networks and credentials, encryption, retention, and recovery testing frequency.
- Maintains the criticality tiers for University systems and the recovery time objectives (RTOs) and recovery point objectives (RPOs) assigned to each, working with system owners and the University's business continuity function on the business impact analysis.
- Serves as ISO's point of contact for resiliency architecture, and reviews new systems and major changes for recoverability before they go into production.
- Reviews requests for exceptions to the standard and recommends approval or denial to the CISO.
- Develops and maintains the annual recovery testing and exercise program, prioritized by system criticality.
- Plans, facilitates, and reports on technical recovery tests and tabletop exercises covering both conventional outages and cyber scenarios, including ransomware, destructive attacks, compromise of identity and privileged access systems, loss of a cloud region or major software-as-a-service provider, and a faulty vendor update affecting many systems at once.
- Verifies backups can be restored within the required RTO and RPO, restored data is free of tampering or malware, and recovery does not reintroduce an attacker's access.
- Coordinates joint exercises with the incident response team and with University leadership.
- Tracks remediation of test findings to closure.
- Helps ensure the incident response plan and recovery plans work together, including the decision points for isolating systems, declaring a disaster, and restoring from known-good copies.
- Helps define the recovery order for foundational services such as identity, DNS, core network, privileged access, and the backup infrastructure itself, and plan for recovery when normal tools, accounts, and communication channels are unavailable.
- Maintains offline copies of critical recovery documentation and out-of-band communication arrangements.
- Coordinates recovery activities during major incidents and participates in post-incident reviews of how recovery performed.
- Assesses current architecture against required RTOs and RPOs and records gaps in the ISO risk register with owners and target dates.
- Maps the program to applicable frameworks and obligations, including the NIST Cybersecurity Framework 2.0 Recover function, NIST SP 800-34 contingency planning guidance, HIPAA contingency plan requirements for systems holding electronic protected health information, federal research security requirements, and cyber insurance requirements.
- Prepares evidence for audits and compliance attestations.
- Assesses the resiliency of cloud and third-party providers as part of ISO's third-party risk reviews and recommends contract terms.
- Reports resiliency metrics, such as test coverage, the share of critical systems meeting their RTO, backup immutability coverage, and open findings, to the CISO quarterly as input to executive and Board reporting.
- Keeps current on attacker techniques that target backups and recovery, and new recovery methods as University systems move to cloud and distributed platforms.
- Uses a deep understanding of IT expertise to develop and implement security and compliance policies, guidelines, and safe practices for University-wide computing and networking systems.
- Guides communications with users to understand their security needs and supports the implementation of procedures to accommodate them. Ensures that user community understands and adheres to necessary procedures to maintain security.
- Performs other related work as needed.
Minimum Qualifications
Education:
Minimum requirements include a college or university degree in related field.
Work Experience:
Minimum requirements include knowledge and skills developed through 5-7 years of work experience in a related job discipline.
Certifications:
---
Preferred Qualifications
Education:
- Bachelor's degree in information technology, computer science, information security, or a related field.
Experience:
- At least five years of experience in disaster recovery, IT resiliency, or business continuity, in a planning, coordination, or administrative capacity.
- Hands-on experience with recovery technology, such as enterprise backup platforms (Commvault, NetBackup, Rubrik, Cohesity), immutable or isolated backup storage, replication and recovery orchestration tools (VMware Site Recovery Manager or equivalent), or cloud recovery services (AWS Elastic Disaster Recovery, AWS Backup, Azure Site Recovery).
- Planning and running recovery tests or tabletop exercises.
- Recovering from, or exercising for, a real cyber incident.
- Familiar with recovery of identity systems such as Active Directory and Microsoft Entra ID.
- Background in higher education, research, or another environment where IT is decentralized.
- Balancing the needs of multiple stakeholders and navigating complex policy, process, and people-related organizational dynamics.
- Contributing to and coordinating initiatives across teams, including during periods of change.
Technical Skills or Knowledge:
- Working knowledge of information security, including incident response, identity and access management, and common attack patterns such as ransomware.
- Familiarity with HIPAA, NIST SP 800-171, and the NIST Cybersecurity Framework.
Preferred Competencies
- Builds trust through honesty, integrity, and collaborative working relationships.
- Strong written and verbal communication skills to explain the reasoning behind recommendations and interact effectively with all levels of the organization.
- Collaborates effectively with IT partners and supporting teams, and influences without direct authority to move work to completion.
- Anticipates and balances the needs of multiple stakeholders across IT Services and campus partners.
- Plans and prioritizes work to meet commitments aligned with organizational goals.
- Contributes to strategy development by identifying future risks and opportunities.
- Takes initiative on new challenges and follows through with a sense of urgency.
- Works effectively in ambiguous situations where the path forward is not yet clear.
- Navigates complex policies, processes, and organizational dynamics to keep work moving.
- Values differences and encourages open dialogue and inclusive collaboration.
Working Conditions
- Hybrid work schedule, onsite and remote as determined by business needs.
- Participation in on-call and incident response rotations, including after-hours work during major incidents and scheduled exercises.
Application Documents
- References Contact Information (3)(required)
The University of Chicago uses AI-assisted tools to streamline and augment some recruitment processes; however, AI is not used to make hiring decisions.
When applying, the document(s) MUST be uploaded via the My Experience page, in the section titled Application Documents of the application.
Job Family
Information Technology
Role Impact
Individual Contributor
Scheduled Weekly Hours
37.5
Drug Test Required
No
Health Screen Required
No
Motor Vehicle Record Inquiry Required
No
Pay Rate Type
Salary
FLSA Status
Exempt
Pay Range
$125,000.00 - $135,000.00
The included pay rate or range represents the University’s good faith estimate of the possible compensation offer for this role at the time of posting.
Benefits Eligible
Yes
The University of Chicago offers a wide range of benefits programs and resources for eligible employees, including health, retirement, and paid time off. Information about the benefit offerings can be found in the Benefits Guidebook.
Posting Statement
The University of Chicago is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, sexual orientation, gender, gender identity, or expression, national or ethnic origin, shared ancestry, age, status as an individual with a disability, military or veteran status, genetic information, or other protected classes under the law. For additional information please see the University's Notice of Nondiscrimination.
Job seekers in need of a reasonable accommodation to complete the application process should call 773-702-5800 or submit a request via Applicant Inquiry Form.
All offers of employment are contingent upon a background check that includes a review of conviction history. A conviction does not automatically preclude University employment. Rather, the University considers conviction information on a case-by-case basis and assesses the nature of the offense, the circumstances surrounding it, the proximity in time of the conviction, and its relevance to the position.
The University of Chicago's Annual Security & Fire Safety Report (Report) provides information about University offices and programs that provide safety support, crime and fire statistics, emergency response and communications plans, and other policies and information. The Report can be accessed online at: http://securityreport.uchicago.edu. Paper copies of the Report are available, upon request, from the University of Chicago Police Department, 850 E. 61st Street, Chicago, IL 60637.
