Senior Cybersecurity Recovery Architect

The Senior Cybersecurity Recovery Architect is a hands-on technical leader responsible for designing, deploying, and continuously validating Nutrien’s cyber resilience recovery capabilities. The role focuses on rapid restoration of critical systems and data following a security incident through structured recovery environments, repeatable engineering, and continuous exercise and improvement.

Location and Employment Details

• Location: Loveland, CO (onsite)
• Salary: USD 121,500 - 200,310 per year
• Minimum Experience: 10 years
• Education: Relevant undergraduate degree, or relevant technical diploma

Core Responsibilities

• Engineer secure Isolated Recovery Environments (IRE) and clean room infrastructure
• Maintain infrastructure used for cyber recovery exercises and live declared events
• Execute end-to-end recovery testing cycles for critical systems
• Validate Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)
• Develop recovery runbooks, playbooks, and automated restoration scripts
• Ensure workloads are sanitized to support safe production re-entry
• Validate air-gapped or logically isolated backup and replication pipelines
• Enforce data immutability standards across secondary storage layers
• Mitigate lateral movement and re-infection risks during restoration phases
• Script reproducible Infrastructure as Code (IaC) environments using Python and Bash
• Partner with application owners, DBAs, and platform teams on recovery sequencing
• Manage the enterprise cyber recovery exercise calendar and scheduling
• Design and facilitate simulation scenarios, including ransomware and supply chain attacks
• Report program maturity and health metrics to the CISO and Senior IT Leadership
• Mentor junior engineers on clean room protocols and regulatory compliance standards

Requirements

• A relevant undergraduate degree with 10+ years of progressive engineering experience across infrastructure, platform, or organizational resilience domains; or a relevant technical diploma with 15+ years of progressive engineering experience across the same domains
• Relevant cybersecurity or recovery certifications would be considered an asset
• Proven operational experience implementing and validating technical cyber recovery strategies within a Recovery Environment or clean-room infrastructure
• Active, live-fire scenario testing experience rather than high-level business continuity (BC) or disaster recovery (DR) planning
• Enterprise-level mastery of corporate backup architectures, replication platforms, and data synchronization tools
• Direct experience building automated recovery pipelines using IaC tools such as Terraform or Ansible
• Scripting proficiency in Python, Bash, or PowerShell
• Advanced comprehension of network segmentation, strict identity isolation, and Zero Trust models as applied to compromised network restoration
• Practical understanding of ransomware Tactics, Techniques, and Procedures (TTPs), destructive malware incident response methodologies, and standard forensic triage within an active recovery lifecycle

Technology Stack

• Python
• Bash
• PowerShell
• Infrastructure as Code (IaC)
• Terraform
• Ansible
• Zero Trust

Benefits

• Comprehensive medical, dental and vision coverage
• Retirement program with generous employer matching
• Tuition assistance
• Ongoing learning and training opportunities
• Employee Assistance Programs
• Inclusive leaves
• Paid time for holidays, volunteering, vacation, and wellness
• Paid vacation, sick days and holidays
• Paid personal and maternity/parental leaves
• Employee and Family Assistance Program
• Life insurance
• Disability coverage for positions working more than 30 hours per week
• Annual incentive plan and long-term incentive plan eligibility

Isolated & Clean Room Recovery

• Engineer secure Isolated Recovery Environments (IRE) and clean room infrastructure
• Maintain infrastructure for cyber recovery exercises and live declared events
• Execute end-to-end recovery testing cycles for critical systems
• Validate Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)
• Develop recovery runbooks, playbooks, and automated restoration scripts
• Ensure workloads are sanitized to guarantee safe production re-entry

Recovery Architecture & Engineering

• Validate air-gapped or logically isolated backup and replication pipelines
• Enforce data immutability standards across all secondary storage layers
• Mitigate lateral movement and re-infection risks during restoration phases
• Script reproducible Infrastructure as Code (IaC) environments using Python and Bash
• Partner with application owners, DBAs, and platform teams on recovery sequencing

Exercise Program & Continuous Improvement

• Manage the enterprise cyber recovery exercise calendar and scheduling
• Design and facilitate diverse simulation scenarios including ransomware and supply chain attacks
• Report program maturity and health metrics to the CISO and Senior IT Leadership
• Mentor junior engineers on clean room protocols and regulatory compliance standards