Sr. Business Continuity Specialist | أخصائي أول استمرارية الأعمال

ROLE OBJECTIVE
Establish and maintain the Otech business continuity management system (BCMS) as part of the Enterprise Governance, Risk & Compliance function, aligned with ISO 22301 and integrated with the enterprise risk management framework. The role owns the business continuity policy, the business impact analysis methodology, the plan standards, the exercise program and continuity reporting, and prepares Otech for ISO 22301 certification. It works as part of the independent second line: it sets the standards, facilitates, challenges, monitors and reports, while divisions own their continuity plans and recovery and the technology function owns disaster recovery.
RESPONSIBILITIES
Business Continuity Management System (ISO 22301)
• Establish, document and maintain the BCMS aligned with ISO 22301, Omantel Group requirements and the ERM framework, and drive it to certification readiness
• Develop and maintain the business continuity policy, BCMS scope, objectives and procedures through the policy lifecycle
• Define business continuity roles across the three lines and maintain the network of first-line continuity coordinators in each division
• Maintain the BCMS document set and records: business impact analyses, continuity risk assessments, strategies, plans, exercise reports and management review inputs
• Run the BCMS management review cycle and track nonconformities and corrective actions to closure

Business Impact Analysis & Continuity Risk Assessment
• Define and maintain the business impact analysis methodology, templates and recovery criteria, consistent with the enterprise risk scoring criteria
• Facilitate business impact analysis with every division, challenge first-line inputs, and consolidate the results into an enterprise view of critical activities, dependencies and recovery priorities
• Coordinate continuity risk assessments of critical activities, sites, suppliers and technology dependencies, and feed the results into the enterprise risk register with named first-line owners
• Maintain the register of critical activities, single points of failure and critical supplier dependencies, and refresh it on the annual cycle and on material change

Continuity Strategies, Plans & Exercise Program
• Define the standards and templates for business continuity strategies, business continuity plans and crisis management procedures, and guide divisions in preparing their own plans
• Review divisional continuity plans against the standards, the business impact analysis results and the disaster recovery plans owned by the technology function, and track remediation of gaps
• Design and run the annual exercise program (tabletop, simulation and integrated exercises with disaster recovery tests), and document results, lessons learned and corrective actions
• Maintain the crisis management framework (activation, escalation and communication procedures) and support the Crisis Management Team during activations and post-incident reviews
• Coordinate continuity requirements for critical suppliers and partners with Procurement and contract owners, and verify supplier continuity assurance evidence

Integration with ERM, Cyber GRC, QA & HSE and Disaster Recovery
• Integrate continuity and resilience risks into the enterprise risk register and monitor treatment progress with the risk owners
• Align the BCMS with the ISO 27001 ISMS, incident management and disaster recovery arrangements of cyber GRC and the technology function, without duplicating documentation or reviews
• Define and monitor continuity and resilience key risk indicators as part of the enterprise KRI set and highlight indicators breaching tolerance
• Work with QA & HSE on the interfaces between emergency response, site safety and business continuity so that plans hand over cleanly
• Contribute BCMS reviews, exercises and certification dates to the integrated assurance calendar

Compliance, Reporting & Decision Support
• Map business continuity and resilience obligations (TRA / MTCIT license conditions, Cyber Defense Centre requirements, Omantel Group requirements and obligations inherited from regulated customers) into the compliance obligations register and monitor adherence
• Prepare responses to customer and regulator business continuity assurance requests (due diligence questionnaires, audits and certification evidence) with the account and delivery teams
• Produce BCMS reporting for the Risk & Compliance Committee, Executive Committee and Omantel Group Risk: readiness status, plan currency, exercise results and open corrective actions
• Provide scenario-based insight on major disruption scenarios (site loss, extended service outage, critical supplier failure, cyber incident, pandemic) to support leadership decision-making
• Escalate overdue plan reviews, failed exercises and untreated continuity risks to the Senior Manager GRC without delay

Team Contribution & Development
• Deliver business continuity awareness and training for plan owners, continuity coordinators and crisis team members
• Maintain BCM tools, templates, records and document control within the GRC document set
• Deliver against personal KPIs, the team competency matrix and the certification roadmap
• Apply best practices in solutioning, storytelling and commercial awareness in all outputs

ROLE SPECIFICATIONS
Qualification
Bachelor's in Business Administration, Risk Management, Information Technology, Engineering or relevant
Certification
• BCI Certificate (CBCI) or DRI Certified Business Continuity Professional (CBCP) held; MBCI preferred
• ISO 22301 Lead Implementer or Lead Auditor (held or in progress)
• ISO 31000 Risk Manager or ISO 27001 Lead Implementer / Auditor desirable
Experience
• 5+ years in business continuity, operational resilience, crisis management or disaster recovery roles
• Hands-on experience running business impact analyses, writing continuity plans and delivering exercise programs, preferably within an ISO 22301 certified BCMS
• Experience in ICT / data center / cloud / telecom services preferred
Skills
• BCMS design & operation (ISO 22301, BCI Good Practice Guidelines)
• Business impact analysis & continuity risk assessment
• Continuity plan standards, writing & review
• Exercise design & facilitation
• Crisis management & communication
• Stakeholder coordination & reporting