Business Continuity Specialist

ShopeePay; Metro Manila; On-site; PHP 900,000 - 1,300,000; Full time

Job summary

ShopeePay is seeking a BCM Officer to lead the development, implementation, and maintenance of business continuity, disaster recovery, incident response, and crisis management capabilities. You will manage the day-to-day resilience framework in compliance with BSP and industry standards.

You will identify critical operations, map dependencies, and coordinate with risk management teams to ensure effective recovery objectives and testing.

Qualifications

• Bachelor's degree in business, management, industrial engineering, information technology, or a related field.
• Professional certification in business continuity, risk management, or audit (e.g., CBCP, CBCI), is an advantage.
• At least three (3) years of relevant experience in business continuity management, operational resilience, disaster recovery, operational risk management, or internal audit.

Responsibilities

• Maintain the BCM framework and integrate it with risk management processes (operational risk, information security, cyber resilience, third party risk, ERM).
• Identify and validate critical operations and dependencies; escalate vulnerabilities with action plans.
• Develop, implement, and maintain business continuity, disaster recovery, incident response, and crisis management plans and procedures.
• Provide BCM input to risk assessments of projects, products, services, and changes; assess impact on recovery capabilities.
• Investigate incidents and near misses; prepare corrective actions and monitor closure.
• Develop and refresh BCM risk indicators, reporting, and governance materials.
• Plan and conduct testing and exercises for disruption scenarios; document results and gaps.
• Assess continuity of third party providers and monitor dependency risk.
• Ensure regulatory compliance and prepare submissions and responses.
• Design training and awareness activities to ensure readiness.

Skills

Business Continuity

Operational Resilience

Incident Response

Crisis Management

Risk Assessment

Regulatory Compliance

Regulatory Reporting

Vendor/Third-Party Risk

BCM Framework

Training & Awareness

Education

Bachelor's degree in business/management/IT

Tools

ISO 22301

Job description

The Business Continuity Management (BCM) Officer is responsible for the development, implementation, and maintenance of the Company's business continuity, disaster recovery, incident response, and crisis management capabilities, and for the day-to-day administration of the Company's operational resilience framework, in compliance with BSP Circular No. 951 (Business Continuity Management Guidelines), BSP Circular No. 971 (Guidelines on Risk Governance), BSP Circular No. 1203 (Guidelines on Operational Resilience), and other related rules, regulations, and industry standards.

About the Role

The BCM Officer plays a crucial role in ensuring the operational resilience of the Company through effective business continuity management practices.

Responsibilities

Operational Resilience and BCM Framework:

• Maintain the Company's business continuity and operational resilience framework and ensure its integration with related risk management processes, including operational risk, information security and cyber resilience, third party risk, and enterprise risk management.
• Identify and periodically validate critical operations and their supporting dependencies, including people, processes, technology, information, facilities, and service providers.
• Maintain the dependency mapping of critical operations and **escalate** identified vulnerabilities together with proposed action plans.

Business Continuity and Recovery Planning:

• Develop, implement, and maintain business continuity, disaster recovery, incident response, and crisis management plans and their supporting procedures.
• Conduct and maintain business impact analysis and recommend recovery objectives and tolerances for disruption for approval through the prescribed governance route.
• Maintain the supporting recovery arrangements, contact and escalation protocols, and response and recovery procedures.

Risk Assessment of Projects and Change Initiatives:

• Provide business continuity and resilience input to risk assessments of projects, new products, services, systems, service providers, and material changes to existing processes.
• Assess the effect of proposed initiatives on existing recovery capability and on established tolerances for disruption and recommend the appropriate continuity and recovery requirements.
• Document residual risks, endorse them through the applicable risk acceptance and escalation process, and monitor agreed mitigating actions to completion.
• Review the adequacy of continuity arrangements following implementation and update the relevant documentation.

Incident Investigation and Continuity Events:

• Investigate incidents and near misses that disrupt or may disrupt critical operations, including determination of root cause, control gaps, and actual and potential impact.
• Prepare incident investigation reports with recommended corrective and preventive actions and monitor open items to closure.
• Maintain incident records and ensure that lessons learned are reflected in the relevant plans, scenarios, and testing activities.
• Support incident escalation, regulatory notification, and related correspondence as required.

Key Risk Indicator Monitoring and Reporting:

• Develop, maintain, and periodically review business continuity and operational resilience key risk indicators, ensuring that each indicator is measurable and supported by a defined data source, owner, and reporting frequency.
• Monitor indicator performance against approved thresholds and elevate results in accordance with the Company's risk appetite and escalation requirements.
• Prepare business continuity inputs to periodic management and committee level risk reports, and raise inconsistencies among appetite measures, indicator definitions, and approved recovery objectives.

Testing and Exercises:

• Develop and implement the periodic testing and exercise program covering severe but plausible disruption scenarios relevant to the Company's business and risk profile.
• Plan, facilitate, and document tests and exercises of varying type, scope, and duration, including those involving critical service providers.
• Evaluate results against recovery objectives and tolerances for disruption, document gaps, and monitor corrective actions to closure.
• Report results, residual gaps, and action plans to management and the relevant oversight committee.

Third Party and Dependency Management:

• Assess the continuity and recovery capability of critical service providers and their ability to support the Company's tolerance for disruption.
• Review continuity and resilience provisions in service provider arrangements, and monitor dependency and concentration risk.

Regulatory Compliance and Reporting:

• Maintain BCM policies, procedures, and registers in compliance with applicable regulatory issuances and industry standards, and monitor regulatory developments affecting business continuity and operational resilience.
• Prepare regulatory submissions, disclosures, and self-assessments relating to business continuity and operational resilience.
• Support regulatory examinations, audits, and independent reviews, including preparation of documentation and responses, and monitor commitments to closure.

Training, Awareness, and Readiness:

• Design and conduct business continuity, incident response, and crisis management training and awareness activities.
• Maintain awareness materials and validate the readiness of personnel holding assigned continuity roles.

Continuous Improvement and Other Duties:

• Review the framework, plans, scenarios, and indicators periodically and upon any material change, incident, or regulatory issuance.
• Benchmark practices against applicable standards and prevailing industry practice and recommend enhancements.
• Perform other related risk management, governance, and reporting duties as may be assigned by the immediate superior.

Qualifications

• Bachelor's degree in business, management, industrial engineering, information technology, or a related field.
• Professional certification in business continuity, risk management, or audit (e.g., CBCP, CBCI, ISO 22301), is an advantage.
• At least three (3) years of relevant experience in business continuity management, operational resilience, disaster recovery, operational risk management, or internal audit, preferably with a bank, electronic money issuer, payment service provider, or other BSP supervised financial institution.
• Familiarity with, or with demonstrated working knowledge of relevant BSP issuances on business continuity, risk governance, and operational resilience, and of recognized standards such as ISO 22301.
• Demonstrated ability to conduct business impact analysis, dependency mapping