Resilience Testing Lead
Smartsuite
A complete application in a minute
Tailored resume and cover letter, ready to send.
Job summary
Capitolis seeks a Resilience Testing Lead to plan and run our scenario testing and exercise program, including severe-but-plausible scenarios, tabletop and live exercises, and impact tolerance tests. You will convert findings into corrective actions and track them to closure, reporting results and lessons learned to the resilience lead and regulators.
The role interfaces with risk management, continuity, IT disaster recovery, and crisis teams to ensure evidence-based regulatory compliance and
Qualifications
- Experience designing and executing resilience testing programs.
- Ability to translate test findings into corrective actions and regulator-ready evidence.
Responsibilities
- Design the annual testing and exercise program.
- Develop severe-but-plausible scenarios for critical services.
- Facilitate tabletop and live exercises.
- Test impact tolerances and document outcomes.
- Convert findings into corrective actions and track closure.
- Report test results and lessons learned to leadership and regulators.
Skills
Tools
Job description
The Resilience Testing Lead plans and runs the scenario testing and exercise program: severe-but-plausible scenarios, tabletop and live exercises, impact tolerance tests and the evidence regulators expect. They turn results into corrective actions and track them to closure.
The Resilience Testing Lead plans and runs the scenario testing and exercise program: severe-but-plausible scenarios, tabletop and live exercises, impact tolerance tests and the evidence regulators expect.
- Design the annual testing and exercise program
- Develop severe-but-plausible scenarios for important business services
- Facilitate tabletop and live exercises
- Test impact tolerances and document outcomes
- Convert findings into corrective actions and track closure
- Report test results and lessons learned to the resilience lead and regulators
The GRC processes this role owns, touches and depends on.
accountable for the process
Operational resilience
contributes or approves
Issues and actions
Reporting
consumes its output
Risk management
Third-party risk
Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Resilience Testing Lead: navy is owned, blue is touched, grey is depended on.
-
First line
The business and its control owners
Run the processes, own the controls, fix the issues
-
Second line
Risk, compliance and the domain programmes
Set the frameworks, assess, monitor and advise
-
Third line
Internal audit
Independent assurance to the board and audit committee
Who this role reports to, who reports to them, and the peers they work with most.
The Resilience Testing Lead owns the scenario testing and exercise program and is accountable to the Head of Operational Resilience for showing that important business services stay within impact tolerance. SmartSuite runs the program as records, so each exercise leaves evidence, each finding becomes an action and the regulator's question is answered from the file.
Tabletop and live exercises are planned on one schedule per important business service, tasks sent automatically and participant engagement tracked as the exercise runs. The program is a set of records with status, not a planning deck.
Scenarios are built against the critical service map, so each one stress-tests the real processes, systems, vendors and teams behind a service. Results and impact ratings are recorded against the scenario, so the next run starts from the last result.
Each test records whether the service stayed within its impact tolerance, with the outcome scored and the evidence attached. Over time the dashboard shows which services have been tested, when and with what result.
The continuity plans the Business Continuity Manager owns and the BIAs the Business Continuity Analyst maintains sit in the same workspace as your exercises, so a test draws on the current plan and its result feeds the next plan review.
The IT Disaster Recovery Lead's recovery steps and the Crisis Management Lead's playbook escalations can be run inside one exercise, with every notification and decision recorded. The debrief covers the whole response, not three separate accounts.
Third-party dependencies are mapped to each critical service, so a scenario can take a supplier out and show which services and tolerances it threatens. The finding goes to the vendor's record as well as to your action list.
Each exercise finding becomes a corrective action with an owner, a due date and automated follow-up, linked to the plan or control it changes. Closure requires the update, so a lesson learned becomes a plan change rather than a line in a report.
The AI Assistant in a SmartDoc field drafts the scenario test summary, lessons-learned report or regulatory response narrative from the exercise record, so the Head of Operational Resilience gets a consistent write-up after every test and you edit rather than start from blank.
Full histories of tests, incidents, reviews and controls are kept with audit trails and role-based permissions, structured for DORA, FFIEC and ISO 22301 requirements and the PRA's severe-but-plausible testing expectations. The examiner's sample is already in order.
Operational resilience. Schedules exercises, captures results and scores impact tolerance tests against each important business service.
Issues and actions. Converts exercise findings into corrective actions with owners and tracks them to closure.
Reporting. Produces regulator-ready testing evidence and lessons-learned reports.
Operational Resilience Define critical services, map dependencies, and validate recovery strategies to ensure business continuity, regulatory alignment, and organizational resilience.
Crisis Management Coordinate executive-level crisis response with response workflows, live dashboards, and aligned actions across leadership and operational teams.
Issues Management Track and remediate issues across audits, risk, and compliance with structured workflows, clear ownership, and real-time visibility into resolution status.
ISO 22301:2019 clause 8.5 requires an exercise and test program; the UK PRA's SS1/21 and the FCA's rules require firms to test important business services against severe-but-plausible scenarios and evidence they stay within impact tolerance. DORA Articles 24 to 27 require a digital operational resilience testing program, with threat-led penetration testing for significant entities, built on TIBER-EU (the UK equivalent is CBEST).
Other sectors prescribe the cadence: CMS requires hospitals to run two exercises a year; FEMA's HSEEP methodology governs public sector exercises; SOC 2 and ISO/IEC 27001:2022 auditors look for tested recovery plans at technology providers.
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
