Director - Business Continuity

If you are looking to make an impact on a meaningful scale, come join us as we embrace the Power of One!We strive to be an employer of choice and establish a reputation for being a talent rich organization where Associates can grow their career caring for others. For over a century, we’ve served the health care needs of the people of Memphis and the Mid-South.The Director of Business Continuity is responsible for building, leading, and maturing Methodist Le Bonheur Healthcare's enterprise Business Continuity Management (BCM) program as a core capability of the Security and Emergency Management function. This leader will establish the governance, operating model, standards, tools, methods, and executive reporting required to ensure MLH can sustain or rapidly restore critical clinical, operational, financial, digital, and administrative services during and after disruptive events. This role provides enterprise leadership across acute care, ambulatory operations, clinical and ancillary services, revenue cycle, supply chain, digital health, information technology, facilities, compliance, and third-party partners. The Director will distinguish and integrate related resilience disciplines: Business Continuity Management focuses on sustaining essential operations and clinical services; Crisis Management provides executive command, decision-making, escalation, and communications during high-impact events; and Disaster Recovery restores technology infrastructure, applications, data, and access in alignment with business-defined priorities. This role is accountable for ensuring those capabilities operate as an integrated resilience system without conflating ownership or scope. Models appropriate behavior as exemplified in MLH Mission, Vision and Values.Working at MLH means carrying the mission forward of caring for our community and impacting the lives of patients in every way through compassion, a deliberate focus on service expectations and a consistent thriving for excellence.A Brief OverviewThe Director of Business Continuity is responsible for building, leading, and maturing Methodist Le Bonheur Healthcare's enterprise Business Continuity Management (BCM) program as a core capability of the Security and Emergency Management function. This leader will establish the governance, operating model, standards, tools, methods, and executive reporting required to ensure MLH can sustain or rapidly restore critical clinical, operational, financial, digital, and administrative services during and after disruptive events. This role provides enterprise leadership across acute care, ambulatory operations, clinical and ancillary services, revenue cycle, supply chain, digital health, information technology, facilities, compliance, and third-party partners. The Director will distinguish and integrate related resilience disciplines: Business Continuity Management focuses on sustaining essential operations and clinical services; Crisis Management provides executive command, decision-making, escalation, and communications during high-impact events; and Disaster Recovery restores technology infrastructure, applications, data, and access in alignment with business-defined priorities. This role is accountable for ensuring those capabilities operate as an integrated resilience system without conflating ownership or scope. Models appropriate behavior as exemplified in MLH Mission, Vision and Values.What you will doProgram Governance & Strategy • Establish a systemwide BCM governance structure that includes executive sponsorship, cross-functional steering committee oversight, operational workgroups, and clear integration with Emergency Management, IT Disaster Recovery, Cyber Resilience, Enterprise Risk Management, Compliance, and Clinical Operations. • Develop and maintain a RACI/RASCI model that clarifies responsibilities across business continuity, emergency management, crisis management, disaster recovery, incident response, facilities, clinical operations, and third-party resilience. • Establish annual and multi-year BCM objectives aligned to MLH strategic priorities, patient safety, regulatory readiness, operational risk, cyber resilience, and enterprise transformation.Business Impact Analysis & Risk Assessment • Lead the development, deployment, and annual refresh of MLH’s standardized Business Impact Analysis methodology across clinical, operational, administrative, digital, financial, and support functions. • Ensure the BIA is process-first and business-led, focusing on critical clinical and operational processes rather than starting with applications or technology platforms. • Coordinate with IT Disaster Recovery and application owners to align business-defined recovery expectations with RTOs, RPOs, application dependencies, data recovery expectations, and restoration sequencing.Business Continuity Planning • Develop and maintain enterprise BCM standards, templates, playbooks, planning tools, and documentation requirements for departments, service lines, facilities, shared services, and corporate functions. • Oversee the creation, review, approval, and maintenance of business continuity plans for critical functions across acute care, ambulatory, clinical support, administrative, revenue cycle, IT-enabled operations, and supply chain areas. • Develop phased continuity strategies for extended disruptions, including short-duration downtime, multi-day technology outages, cyber events, utility disruptions, supply shortages, facility loss, public health emergencies, and regional disasters.Crisis Management & Operational Resilience • Partner with Security and Emergency Management leadership to ensure BCM is integrated with MLH’s crisis management, emergency operations, Hospital Incident Command System, executive escalation, and incident response structures. • Support crisis activation, executive decision-making, situational awareness, operational prioritization, and continuity/recovery coordination during actual or potential disruptive events. • Coordinate post-incident recovery planning and after-action processes to capture lessons learned, assign corrective actions, and strengthen future readiness.Disaster Recovery Coordination • Maintain a clear distinction between BCM and IT Disaster Recovery while ensuring strong integration between business priorities and technology recovery. • Facilitate operational validation of IT Disaster Recovery plans to ensure recovered systems and restored data actually enable critical clinical and business processes. • Support extended IT downtime preparedness for EHR, clinical systems, imaging, laboratory, pharmacy, revenue cycle, telehealth, identity/access, network, communications, and other critical technology dependencies. • Testing & Exercises • Design and lead an enterprise BCM exercise strategy that includes tabletop exercises, functional exercises, department-level downtime drills, vendor-participation exercises, cyber/technology disruption scenarios, and enterprise-wide resilience simulations. • Ensure exercises test realistic clinical and operational scenarios, including extended EHR downtime, cyber disruption, communications outage, supply shortage, facility loss, utility outage, patient surge, regional disaster, and third-party failure. • Ensure BCM exercise outcomes are reported to the appropriate governance bodies and used to improve plans, training, resource allocation, controls, and executive readiness.Vendor & Third-Party Resilience • Establish and maintain a third-party resilience framework for vendors and partners that support critical clinical, operational, technology, supply chain, revenue cycle, digital health, and administrative functions. • Ensure critical vendor contracts and service relationships address continuity expectations, incident notification, recovery commitments, testing participation, service-level requirements, data recovery, transition support, and exit considerations. • Coordinate vendor participation in exercises where third-party services materially affect patient care, operational continuity, revenue cycle, technology availability, or supply continuity.Regulatory Compliance • Ensure the BCM program supports MLH’s readiness for Joint Commission Emergency Management standards, CMS Emergency Preparedness requirements, HIPAA contingency expectations, state and local requirements, and applicable healthcare accreditation and regulatory obligations. • Maintain documentation that demonstrates alignment with emergency planning, continuity of operations, communication planning, policies/procedures, training, testing, after-action review, and corrective action expectations. • Align BCM program design with recognized frameworks and leading practices, including ISO 22301, BCI Good Practice Guidelines, DRII Professional Practices, ASIS business continuity guidance, FEMA/NIMS, and healthcare emergency management practices.Executive Communications • Develop executive-ready dashboards, briefings, board-level narratives, risk summaries, maturity updates, and decision materials that clearly communicate MLH’s continuity posture. • Provide regular updates to the BCM steering committee, Security and Emergency Management leadership, IT leadership, clinical and operational executives, and other governance forums. • Partner with Communications, Legal, Compliance, Privacy, Emergency Management, and executive leadership to support internal and external crisis communication needs.Metrics, Reporting & Continuous Improvement • Define and maintain BCM performance metrics, maturity indicators, risk indicators, and executive scorecards. • Track core measures including BIA completion, continuity plan completion, plan validation, exercise participation, corrective action closure, critical vendor review completion, training completion, downtime readiness, RTO/RPO alignment, and plan review timeliness. • Benchmark BCM maturity against healthcare and enterprise resilience practices and recommend improvements to strengthen MLH’s operational resilience.Education QualificationsRequired - Bachelor's Degree Experience QualificationsRequired - Minimum of ten (10) years of progressive experience in business continuity, operational resilience, emergency management, crisis management, enterprise risk, IT disaster recovery coordination, healthcare operations, or related disciplines with at least 7 years leading enterprise business continuity management, resilience, crisis readiness, emergency preparedness, or cross-functional operational risk programs.Preferred - Healthcare provider Healthcare provider experience strongly preferred; academic medical center, pediatric, acute care, ambulatory, integrated delivery network, or large health system experience is highly desirable.Substitution allowed - Combination of education and substantial enterprise BCM leadership experience in a complex healthcare system, Fortune 500 resilience program, academic medical center, government emergency management environment, or similarly regulated mission-critical organization equivalent to fourteen (14) years.Skills and AbilitiesExecutive presence and ability to influence senior leaders, physicians, clinical executives, operational leaders, IT leaders, and external partners without relying solely on direct authority.Strong knowledge of BCM, crisis management, emergency management, IT disaster recovery, cyber resilience, operational resilience, enterprise risk, and third-party risk disciplines.Strong understanding of healthcare operations, patient safety, clinical workflows, hospital operations, ambulatory operations, clinical support services, revenue cycle, digital health, supply chain, and regulatory expectations.Working knowledge of EHR, clinical applications, identity/access, network, data, communications, telehealth, digital patient engagement, and revenue cycle system dependencies sufficient to translate technology disruption into operational and patient care impacts.Ability to design and facilitate executive, operational, clinical, technical, and vendor exercises.Ability to develop high-quality policies, standards, playbooks, dashboards, executive briefings, after-action reports, and board-ready materials.Strong analytical capability to assess risk, business impact, downtime tolerance, recovery requirements, dependencies, and readiness gaps.Ability to lead through ambiguity, competing priorities, high-pressure incidents, and matrixed stakeholder environments.Strong change management, facilitation, conflict resolution, negotiation, storytelling, and consensus-building skills.Ability to operate effectively under pressure, manage sensitive information, and maintain composure during high-impact events involving patient care, workforce safety, regulatory exposure, or operational disruption.Demonstrated experience building or materially maturing a BCM program, including governance, policy, BIA methodology, plan standards, training, exercises, reporting, and continuousDemonstrated experience leading BIAs, dependency mapping, recovery strategy development, RTO/RPO alignment, downtime readiness assessments, and continuity plan development.Licenses and CertificationsRequired - Certified Business Continuity Professional - Disaster Recovery Institute InternationalPreferred - Certificate of the Business Continuity Institute (CBCI) Business Continuity Institute (BCI)Preferred - Master Business Continuity Professional - Disaster Recovery Institute InternationalPreferred - Certified Cyber Resilience Professional - Disaster Recovery Institute InternationalPreferred - FEMA IS-00800.b National Response Framework an Introduction - Emergency Management InstitutePreferred - FEMA IS-100c Introduction to the Incident Command System - ICS 100 - National Disaster and Emergency Management UniversityPreferred - FEMA IS-200c Basic Incident Command System for Initial Response - ICS-200 - National Disaster and Emergency Management UniversityPreferred - FEMA IS-700b An Introduction to the National Incident Management System - National Disaster and Emergency Management UniversityPreferred - Six Sigma Black Belt - Authorized Six Sigma Certification IssuerPreferred - Six Sigma Green Belt - Authorized Six Sigma Certification IssuerPreferred - Six Sigma Master Black Belt - Authorized Six Sigma Certification IssuerPreferred - Six Sigma White Belt - Authorized Six Sigma Certification IssuerPreferred - Six Sigma Yellow Belt - Authorized Six Sigma Certification IssuerPreferred - Project Management Professional - Project Management InstitutePreferred - Certified Healthcare Provider Continuity Professional (CHPCP) Disaster Recovery Institute InternationalPreferred - ITIL Certification - PeopleCertPreferred - Certified Information Security Manager - Information Systems Audit and Control AssociationPreferred - Certified Information Systems Security Professional - International Information System Security Certification ConsortiumPreferred - Certified Healthcare Privacy Compliance -CHPC - Compliance Certification BoardSupervision Provided by this PositionManages and directs assigned Associates.Physical DemandsThe physical activities of this position may include climbing, pushing, standing, hearing, walking, reaching, grasping, kneeling, stooping, and repetitive motion.Must have good balance and coordination.The physical requirements of this position are: light work - exerting up to 25 lbs. of force occasionally and/or up to 10 lbs. of force frequently.The Associate is required to have close visual acuity to perform an activity, such as preparing and analyzing data and figures; transcribing; viewing a computer terminal; or extensive reading.The conditions to which the Associate will be subject in this position: The Associate is not substantially exposed to adverse environmental conditions; job functions are typically performed under conditions such as those found in general office or administrative work.Work is generally performed in office, administrative, hospital, command center, and remote/virtual collaboration settings.Requires prolonged periods of computer use, document review, meeting participation, presentation delivery, and executive communication.Requires ability to travel periodically to MLH hospitals, ambulatory sites, corporate locations, emergency operations locations, vendor meetings, and exercise locations.Must be available for on-call escalation, incident response, emergency operations center participation, and after-hours support during actual or potential disruptive events.May be required to report onsite during emergencies, planned exercises, technology outages, severe weather, facility disruptions, cyber events, public health emergencies, or other operational incidents.Our Associates are passionate about what they do, the service they provide and the patients they serve. We value family, team and a Power of One culture that requires commitment to the highest standards of care and unity.Boasting one of the South's largest medical centers, Memphis blends a friendly community, a thriving and growing downtown, and a low cost of living. We see each day as a new opportunity to make a difference in the lives of the people in our community.SummaryLocation: Memphis Professional BuildingType: Full time