IT Resilience Manager

INTRODUCTION

At Burberry, we believe creativity opens spaces. Our purpose is to unlock the power of imagination to push boundaries and open new possibilities for our people, our customers and our communities. This is the core belief that has guided Burberry since it was founded in 1856 and is central to how we operate as a company today.

We aim to provide an environment for creative minds from different backgrounds to thrive, bringing a wide range of skills and experiences to everything we do. As a purposeful, values-driven brand, we are committed to being a force for good in the world as well, creating the next generation of sustainable luxury for customers, driving industry change and championing our communities.

JOB PURPOSE

The IT Resilience Manager helps ensure Burberry's technology services can withstand, respond to and recover from disruptive events. The role provides resilience expertise, assurance and governance across critical services, working with service owners, platform teams, SIAM, cyber security, business continuity and third-party partners.

• IT Resilience Policy: setting the overarching governance, principles, roles, assurance expectations and minimum requirements for technology resilience across critical services.
• Cyber Resilience Policy: ensuring technology services can withstand and recover from cyber-led disruption, including ransomware, destructive attacks, compromised identities and loss of integrity or availability.
• IT Disaster Recovery Policy: ensuring technology services can be restored following disruption through effective recovery planning, recovery objectives, testing, evidence and recovery governance.
• IT Backups Policy: establishing minimum requirements for backup coverage, frequency, retention, protection, restoration testing, evidence and ongoing assurance for critical data and technology services.

The role ensures the IT Resilience policy framework is practical, embedded and aligned to business priorities. Service owners remain accountable for maintaining service-specific recovery capability, while the IT Resilience Manager sets expectations, reviews evidence, tracks gaps and reports on organisational readiness.

The role also leads the annual IT resilience and cyber recovery exercise and supports alignment with wider Business Continuity and Cyber Incident Response activities.

RESPONSIBILITIES

• Maintain a view of critical business services and supporting technology dependencies, ensuring recovery priorities, resilience requirements and recovery approaches reflect business impact.
• Maintain the IT Resilience policy framework, including the overarching IT Resilience Policy and supporting Cyber Resilience, IT Disaster Recovery and IT Backups policies.
• Define clear minimum requirements for recovery planning, backup arrangements, resilience controls, testing, evidence, recovery objectives and reporting.
• Ensure resilience requirements address cyber-led disruption scenarios, including ransomware, destructive attacks, compromised identities, data loss and major service outages.
• Review ITDR plans developed by service owners, platform teams and third-party partners, ensuring they are complete, current and aligned to policy, standards and recovery requirements.
• Review ITDR test plans and test outcomes to confirm recovery activities are appropriately scoped, evidenced and aligned to agreed RTOs, RPOs and business recovery priorities.
• Oversee the annual IT resilience and cyber recovery exercise to test cross-service response, recovery coordination, escalation and decision-making.
• Conduct monthly assurance reviews of recovery plans, backup status, resilience controls, test activity, open risks and overdue remediation actions.
• Maintain resilience reporting for critical technology services, including plan currency, test status, backup assurance, recovery capability (including cyber recovery), open risks and remediation progress.
• Work with service owners and platform teams to ensure resilience and recovery gaps have clear owners, treatment actions and target dates.
• Provide direction on resilience and recovery requirements for service design, architecture, supplier obligations and operational processes, ensuring services are designed to minimise impact and support effective recovery.
• Partner with Cyber Security Operations and IT Risk to ensure ITDR and cyber recovery capabilities address cyber-specific scenarios, including ransomware, data loss, compromised identities and destructive attacks.
• Work with business continuity teams to ensure ITDR, IT resilience and cyber recovery planning, testing and exercising align to wider business continuity and operational resilience requirements.
• Report resilience posture, including ITDR readiness, resilience capability and cyber recovery maturity, along with test outcomes, policy compliance, material gaps and improvement actions to Cyber & Risk leadership and relevant governance forums.

PERSONAL PROFILE

• Proven experience in IT disaster recovery, IT resilience, technology risk, business continuity or resilience assurance roles.
• Strong understanding of IT resilience, cyber resilience, disaster recovery and backup requirements across hybrid cloud and on-premise environments.
• Experience reviewing service-level recovery plans, test evidence and resilience controls against policy and standards.
• Experience leading resilience exercises, simulations or scenario-based testing across multiple services, teams and suppliers.
• Able to work across service owners, platform teams, SIAM, cyber, architecture, suppliers and business continuity stakeholders.
• Strong governance and reporting skills, with the ability to present resilience posture, risks and improvement actions clearly to senior stakeholders.
• Understanding of cyber-led disruption scenarios, including ransomware, data loss, destructive attacks and major service outages.
• Familiarity with service management, supplier management and operational resilience practices is beneficial.
• Relevant certifications such as BCI, ISO 22301, ISO 27001, ITIL or equivalent are desirable.