Location: Waltham, MA (Hybrid)

Targeted Salary Range: $200,000 to $240,000 annually

Reports To: VP, Information Security & Infrastructure Operations

Department: Information Security & Infrastructure Operations

Company Overview

Nova Biomedical is a global leader in advanced analytical and diagnostic technologies supporting healthcare, biotechnology, and life sciences organizations worldwide. Nova depends on secure, reliable, recoverable, and resilient technology and business operations to support employees, manufacturing, research and development, regulated systems, customer commitments, and corporate functions across a global environment.

Position Summary

The Senior Manager, Enterprise Resilience & Service Recovery is the hands-on enterprise capability owner responsible for developing, operating, and continuously improving Nova Biomedical’s business continuity, disaster recovery, cyber recovery, operational resilience, crisis readiness, and major incident management capabilities. The role establishes a unified approach for preparing for disruption, protecting critical operations, coordinating response, restoring services, validating recovery, and converting lessons into measurable improvement.

The position serves as the enterprise Incident Commander for significant events regardless of origin, including cybersecurity incidents, infrastructure outages, cloud or application failures, identity disruptions, telecommunications issues, manufacturing technology interruptions, third-party service failures, facility events, and other conditions that materially affect business operations.

The Senior Manager coordinates technical, business, executive, legal, quality, regulatory, communications, and supplier workstreams while maintaining a clear operating picture, decision cadence, recovery priorities, and accountable actions. This is a player-coach role.

Role Mission

Build and mature an integrated enterprise resilience and incident management capability that enables critical operations to anticipate, withstand, respond to, recover from, and learn from disruption. Engineer recoverability into services and workflows, make incident response consistent across cyber and technology operations, automate repeatable work wherever practical, and replace undocumented knowledge and untested assumptions with clear ownership, reusable playbooks, observable services, and evidence-based recovery confidence.

Work Architecture View

This role is designed around capability ownership and business outcomes rather than the administration of isolated plans. It owns the system of work connecting business services, tasks, workflows, skills, technology, dependencies, risks, recovery objectives, incident decisions, recovery actions, evidence, and continuous improvement.

Core Outcomes

• Maintain practical continuity strategies for critical business, manufacturing, laboratory, and corporate services.
• Improve recovery confidence through tested architecture, current playbooks, known dependencies, assigned ownership, trained teams, and reviewable evidence.
• Establish a consistent command structure for high-severity events across cybersecurity, infrastructure, cloud, applications, suppliers, facilities, and business operations.
• Improve service restoration by quickly establishing business priorities, mobilizing the appropriate capabilities, managing dependencies, and supporting timely decisions.
• Strengthen cyber recovery readiness for identity compromise, ransomware, destructive attacks, unavailable tools, untrusted infrastructure, malicious persistence, and restoration from known-good sources.
• Increase the use of automation and governed AI assistance for readiness checks, workflow routing, evidence collection, status reporting, recovery validation, knowledge retrieval, and repeatable response activities.
• Incorporate resilience and recoverability requirements into new and changed services before deployment.
• Provide accountable leaders with measurable visibility into criticality, recovery objectives, incident performance, testing coverage, material gaps, exceptions, remediation, and risk acceptance.
• Ensure incidents, exercises, tests, audit findings, and supplier disruptions result in assigned improvements that reduce recurrence and strengthen future response and recovery.

Primary Workstreams

• Enterprise Resilience Strategy & Governance
• Business Continuity Management
• Disaster Recovery Engineering
• Cyber Recovery & Ransomware Resilience
• Major Incident Command & Control
• Incident Communications & Stakeholder Coordination
• Incident Detection, Readiness & Service Integration
• Backup, Restore & Recovery Governance
• Recovery Automation, Orchestration & Intelligent Operations
• Resilience Architecture & Design Review
• Testing, Exercises & Continuous Validation
• Manufacturing, Site & Operational Resilience
• Third-Party & Supplier Resilience
• Post-Incident Review, Problem Management & Learning
• Team Leadership & Capability Development
• Metrics, Evidence & Continuous Improvement

Essential Responsibilities

Enterprise Resilience Strategy & Governance

Own and maintain the enterprise resilience and major incident management roadmap, operating model, standards, governance, testing framework, maturity priorities, metrics, and executive reporting. Establish accountability for business continuity, disaster recovery, cyber recovery, backup integrity, service recoverability, incident command, crisis coordination, exercises, remediation, exception management, and risk acceptance.

Business Continuity Management

Lead and continuously improve business impact analysis, critical process identification, continuity planning, service prioritization, dependency mapping, and continuity strategy development across applicable global operations.

Disaster Recovery Engineering

Own the enterprise disaster recovery framework and partner with infrastructure, application, database, network, cloud, identity, manufacturing, and business teams to engineer recoverable services.

Cyber Recovery & Ransomware Resilience

Build and mature cyber recovery strategies that account for identity compromise, destructive activity, impaired administrative tools, malicious persistence, unavailable production networks, contaminated backups, and uncertain system trust.

Major Incident Command & Control

Serve as the Incident Commander, or designate and support an appropriate Incident Commander, for Severity 1 and other material incidents.

Incident Communications & Stakeholder Coordination

Establish communication standards and templates for technical responders, business leaders, executives, users, customers, suppliers, Legal, Privacy, Quality, Regulatory Affairs, Communications, and other stakeholders.

Incident Detection, Readiness & Service Integration

Partner with service management, monitoring, observability, cybersecurity operations, engineering, and application teams to improve the recognition, declaration, severity assignment, routing, mobilization, and escalation of major incidents.

Backup, Restore & Recovery Governance

Establish governance for backup coverage, retention, protection, monitoring, immutability, restore testing, ownership, exceptions, evidence, lifecycle alignment, and recovery dependency management.

Recovery Automation, Orchestration & Intelligent Operations

Identify tasks suitable for simplification, orchestration, scripting, infrastructure as code, configuration automation, workflow integration, automated validation, evidence capture, and governed AI assistance.

Resilience Architecture & Design Review

Participate in architecture, platform, application, cloud, infrastructure, manufacturing, supplier, and significant change reviews to assess resilience and recoverability before deployment.

Testing, Exercises & Continuous Validation

Develop a risk-based program that includes tabletop exercises, technical recovery tests, restore tests, failover exercises, business continuity exercises, cyber recovery simulations, major incident drills, executive crisis exercises, and integrated enterprise scenarios.

Manufacturing, Site & Operational Resilience

Partner with Manufacturing, Quality, Engineering, Facilities, Supply Chain, Environmental Health and Safety, and technology teams to understand critical production, laboratory, utility, facility, operational technology, data, material, and workforce dependencies.

Third-Party & Supplier Resilience

Define resilience and incident response expectations for critical technology providers, cloud services, managed services, logistics partners, suppliers, and other external dependencies.

Post-Incident Review, Problem Management & Learning

Lead blameless, evidence-based post-incident reviews for significant events.

Team Leadership & Capability Development

Operate as a player-coach who sets direction, performs hands-on work, develops others, and coordinates employees, partners, service providers, and matrixed contributors.

Metrics, Evidence & Continuous Improvement

Define meaningful measures for critical service coverage, business impact analysis currency, plan quality, exercise participation, recovery test coverage, recovery success, objective attainment, incident mobilization, restoration performance, communication timeliness, repeat incidents, automation adoption, gap aging, and action closure.

Decision Rights & Accountability

Declare, classify, escalate, and coordinate major incidents in accordance with approved criteria and delegated authority.

Key Working Relationships

• Cybersecurity Operations, Security Engineering, Identity, Governance, Risk and Compliance, Privacy, and Product Security
• Infrastructure, Cloud, Network, Endpoint, Database, Collaboration, Service Management, and Application teams
• Manufacturing, Operational Technology, Engineering, Quality, Laboratory, and Regulatory Affairs
• Business process owners, service owners, application owners, and data owners
• Facilities, Supply Chain, Procurement, Legal, Communications, Human Resources, Finance, and Environmental Health and Safety
• Executive leadership and enterprise crisis-management stakeholders
• Third-party service providers, cloud providers, incident response partners, recovery specialists, insurers, critical suppliers, and specialist consultants

Skills to Bring

• Enterprise business continuity, disaster recovery, cyber recovery, major incident management, operational resilience, infrastructure, cloud, or related experience
• Hands-on leadership of significant technology incidents, recovery tests, restore validation, continuity exercises, or crisis response
• Ability to translate business impact and service criticality into practical response, continuity, recovery, and investment requirements
• Understanding of infrastructure, cloud, identity, network, applications, data, backup, observability, security, supplier, and operational dependencies
• Strong incident command, facilitation, documentation, program ownership, executive communication, and cross-functional influence
• Manager-level judgment with a willingness to perform detailed analysis, testing, planning, communications, and remediation work
• Ability to work effectively during ambiguity, pressure, competing priorities, and incomplete information

Required Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, Risk Management, Emergency Management, or a related discipline, or equivalent practical experience.
• Five or more years of progressive experience across disaster recovery, business continuity, major incident management, cyber recovery, operational resilience, infrastructure operations, cloud engineering, cybersecurity, service management, or related disciplines.
• Experience building, operating, or materially improving enterprise continuity, recovery, resilience, or major incident capabilities across technical and business teams.
• Experience leading high-severity technology or cyber incidents and coordinating multiple technical, business, executive, supplier, and governance workstreams.
• Experience with business impact analysis, dependency mapping, continuity planning, recovery testing, exercises, technical restoration, post-incident review, or corrective action management.
• Working knowledge of infrastructure, cloud, network, identity, applications, data protection, backup and recovery, observability, security, and service management dependencies.
• Ability to lead at the senior manager level while remaining hands-on in incident command, planning, analysis, testing, documentation, architecture review, issue resolution, communications, and event support.
• Strong written, verbal, facilitation, and executive communication skills, including the ability to explain uncertain and rapidly changing conditions without overstating facts.
• Ability to protect sensitive company information and follow documented security, quality, regulatory, compliance, change, and operational procedures.

Preferred Qualifications

• Experience supporting healthcare, life sciences, medical technology, manufacturing, laboratory, industrial, or another regulated environment.
• Experience with enterprise incident command, IT service management, cybersecurity incident response, crisis management, emergency management, or site disruption response.
• Experience with ransomware readiness, cyber recovery, identity recovery, isolated recovery environments, immutable backups, clean-room restoration, or forensic evidence preservation.
• Experience with public cloud recovery, infrastructure automation, orchestration, configuration management, infrastructure as code, workflow platforms, observability, or automated validation.
• Experience with manufacturing technology, operational technology, facility dependencies, site continuity, supply chain resilience, or critical suppliers.
• Experience defining and validating recovery objectives, service continuity requirements, backup strategies, technical recovery runbooks, incident severity frameworks, and communication plans.
• Experience with risk management, audit support, regulatory evidence, vendor resilience, executive reporting, insurance support, or customer assurance activities.
• Relevant certifications or training in business continuity, disaster recovery, cybersecurity, cloud, infrastructure, IT service management, emergency management, crisis management, or operational resilience are desirable but not required.

Core Competencies

• Ownership & Accountability
• Enterprise Incident Command
• Player-Coach Leadership
• Resilience Engineering
• Systems Thinking
• Risk-Based Decision Making
• Technical Judgment
• Business Impact Awareness
• Cross-Functional Influence
• Crisis Communication
• Automation Mindset
• Evidence Discipline
• Learning Culture
• Continuous Improvement
• Composure Under Pressure
• Clear Decision Framing

Success Measures

• Critical business services, enabling technologies, dependencies, accountable owners, continuity strategies, recovery objectives, and validation evidence are visible and current.
• Major incidents are declared, staffed, coordinated, communicated, and transitioned to recovery using a consistent operating model across cyber and infrastructure domains.
• Recovery tests and exercises demonstrate usable capabilities, identify meaningful gaps, and result in verified remediation rather than administrative closure.
• Incident reviews reduce recurrence by addressing systemic causes, missing ownership, weak architecture, insufficient telemetry, unclear decisions, or fragile operating processes.
• Recovery and incident workflows become more reusable, automated, observable, and less dependent on manual coordination or individual knowledge.
• Business and technology leaders understand resilience exposure, active incident status, recovery confidence, decision needs, and investment priorities.
• Capability knowledge and decision rights are distributed across trained teams so Nova can manage extended, simultaneous, or cross-functional disruptions.
• Resilience and recoverability are incorporated into new services, significant changes, supplier relationships, and operating model decisions before incidents occur.

Success Profile

The ideal candidate thinks like an engineer, commands incidents like an experienced operations leader, communicates with executive clarity, and builds capabilities like an enterprise architect. The successful candidate is comfortable setting direction and presenting material risk to leadership while remaining willing to join an incident bridge, structure a response, examine telemetry, challenge a recovery sequence, facilitate a business impact discussion, review backup evidence, coordinate a supplier escalation, lead an exercise, improve a runbook, or work through a failed restoration with engineers. The successful candidate creates a practical operating capability that works during real disruptions. They build trusted partnerships, establish calm and accountable command, use evidence to separate fact from assumption, know when to escalate, and continuously redesign work so Nova can respond and recover with greater speed, confidence, scalability, and resilience.

Working Conditions

Occasional travel may be required. Participation in after-hours recovery tests, exercises, significant incidents, technology outages, cyber events, site disruptions, supplier failures, audit or regulatory activities, and time-sensitive remediation may be required based on operational needs. The role is expected to provide leadership and hands-on support during material business or technology disruptions and may be part of an on-call or incident escalation structure.

Why Join Nova Biomedical

This role offers the opportunity to build and lead an integrated enterprise resilience and incident management capability across cybersecurity, infrastructure, cloud, applications, identity, manufacturing, facilities, suppliers, and critical business operations. The Senior Manager will shape how Nova designs for disruption, leads major incidents, validates recovery, automates recurring work, develops future-ready skills, reduces operational risk, and protects the continuity of a global healthcare technology organization.

Equal Opportunity Employer

Nova Biomedical is an Equal Opportunity Employer committed to creating a diverse and inclusive workplace.

Privacy Policy