Careers in crisis management and business continuity rarely start with a plan. Most of the people I’ve worked with over the past 30 years came in sideways: from law enforcement, emergency management, the military, IT, communications, audit, or operations. Very few set out in college to become a business continuity manager.
That’s good news if you’re a student or a career changer. This field rewards people who can stay calm, make decisions with incomplete information, and explain risk in the language of the business. You can build those skills from almost anywhere.
Here’s what the jobs are, how people get in, which certifications matter, what you’ll be asked in an interview, and how to move up.
What Crisis Management and Business Continuity Professionals Do
Crisis management leads the organization’s response when something threatens its people, operations, reputation, or strategy. Business continuity keeps the organization delivering its most important products and services through a disruption. IT disaster recovery restores the technology both depend on. In a smaller company, one person may cover all three. In a large one, each is its own team.
The roles you’ll see most often:
| Role | What the work looks like |
| Business continuity analyst or planner | Runs business impact analysis (BIA) interviews, writes and maintains plans with business units, supports exercises, and keeps contact lists and plan data current |
| Business continuity manager | Owns the program: policy, governance, the BIA cycle, the exercise calendar, and reporting to executives |
| Crisis management manager | Owns the crisis framework and crisis team, runs exercises, and supports or leads the response when the team activates |
| IT disaster recovery manager | Owns recovery plans and testing for critical systems, and connects IT recovery to what the business needs |
| Crisis communications | Prepares messages and channels in advance, and manages communication with employees, customers, media, and regulators during a crisis |
| Global security operations center (GSOC) or intelligence analyst | Monitors events around the world, assesses what matters to the company, and escalates to the crisis team |
| Head or director of resilience | Leads some or all of the above, sets strategy, and earns executive support and funding |
What does a business continuity planner do?
The planner is the most common entry point. Most of the job is conversation, not documents. You sit with a business unit, learn what it does, find out how long it can be down before the damage becomes serious, and figure out what it needs to keep going. Then you turn that into a plan people can actually use, test it in an exercise, and update it when the business changes. Good planners spend more time listening than writing.
Every regulated industry hires for these roles: financial services, healthcare, utilities, technology, and government, along with large retailers, manufacturers, and consulting firms. Government emergency management and continuity of operations is a parallel track with its own training and certifications.
How People Get Into Crisis Management
There’s no single degree for this field. Business, emergency management, communications, public policy, and information technology all work. What matters more is evidence that you can handle pressure, learn a business, and communicate clearly.
My own path is a good example of how sideways it can be. I started in law enforcement in rural Indiana, then joined Target in loss prevention and spent about 11 years in field security roles. In 2004, I led security for most of the company’s New England market when the Democratic National Convention came to Boston. When I asked headquarters for the plan, the answer was “you should make a plan.” So my team built one. That work got me invited onto a new headquarters crisis management team.
Years later, I was asked to lead the combined crisis management and business continuity function. I told my would-be boss I knew very little about business continuity. He laughed. He said he didn’t need a subject matter expert. He had those. He needed someone who could communicate, sell, and explain the program across the company.
He was right. I’ve told that story more times than I can count, because it’s the most useful thing I know about careers in this field. I tell the rest of the story in Walking Away from a Fortune 30 Company.
Common ways in:
- From an adjacent field. Emergency services, the military, security, IT operations, audit, and communications all build skills that transfer directly.
- From inside the business. Volunteer to be your department’s continuity plan owner, or ask to sit on the business continuity steering committee. It’s one of the best development opportunities a mid-level leader can get.
- Entry-level roles. Analyst, coordinator, and planner jobs at large companies, government agencies, and consulting firms.
- Internships and volunteering. Emergency management offices, hospitals, the Red Cross, and community emergency response teams all give you real exposure to how organizations respond.
The Skills That Matter
- Communication and influence. You’ll spend most of your career persuading people who don’t report to you to do work they didn’t plan for. Your technical knowledge gets you in the room. It’s your influence that keeps you there.
- Business fluency. Early in my career, I wanted to prosecute a woman committing refund fraud at my store. My boss told me I was approaching it as a cop. The job was to protect the store and support the business. Learn how your company makes money, and frame risk in those terms.
- Calm decisions with incomplete information. In a crisis, you’ll never have all the facts. You need to be decisive about the process and willing to change the answer as you learn more.
- Imagination. Most crises that catch organizations off guard were a failure of imagination before they were a failure of planning.
- The ability to simplify. A 60-page plan nobody reads protects no one. The people who advance are the ones who make it simple.
- Technology literacy. Cloud, identity, backups, and now AI. You don’t need to be an engineer, but you need to understand how your company’s technology fails and recovers.
On AI: it’s coming for the repeatable parts of this work, like first-draft plans and templated messages. If your value is in the doing of a thing, your role is at risk. If it’s in judgment and influence, AI makes you faster. I talked through this on Managing Uncertainty, Episode 301: Is AI Coming for Your Resilience Job?
Certifications: Which Ones Matter
Get certified as soon as you can. Many roles require it or expect it within a set time, and it gives you a common vocabulary and a professional network. But never argue “because I’m certified” with an executive. Certifications get you hired. Results get you heard.
The two main certifying bodies:
- DRI International (DRII), the most common designation in North America. The Associate Business Continuity Professional (ABCP) is for people with less than two years of experience and requires passing the qualifying exam. The Certified Business Continuity Professional (CBCP) requires at least two years of practical experience in five of DRII’s professional practice areas. The Master Business Continuity Professional (MBCP) is the advanced level.
- The Business Continuity Institute (BCI), more widely recognized in Europe, Asia, Africa, and the Middle East. The CBCI comes from passing the BCI’s exam on its Good Practice Guidelines. MBCI, the member grade, adds demonstrated experience.
For government continuity and emergency management, FEMA’s Emergency Management Institute offers free courses. The certifications section of our Ultimate Guide to Business Continuity covers how to choose.
What the Jobs Pay
Pay varies widely by industry, region, and scope. As one reference point, PayScale puts the average base salary for a US business continuity manager at about $108,000, based on data updated in November 2025 (PayScale). Directors and heads of resilience at large companies earn considerably more.
Crisis Management and Business Continuity Interview Questions
These are the questions I’d ask, and what a strong answer shows.
- Walk me through a business impact analysis you’ve led. Shows you know the process and can get time-sensitive answers out of busy people.
- What’s the difference between business continuity, crisis management, and IT disaster recovery? Shows you understand where one hands off to the next.
- Tell me about a time you had to make a decision without all the facts. Shows judgment under pressure. Lead with the decision, then the reasoning.
- How would you get an executive who doesn’t see the value to support this program? Shows influence and business fluency. Talk about their priorities, not yours.
- How do you design an exercise that tests decisions, not just a plan? Shows you know the difference between a tabletop exercise that checks a box and one that finds gaps.
- What did your last After-Action Report (AAR) change? Shows you close the loop. Findings nobody acts on are just paperwork.
- How would you characterize our biggest continuity risk, based on what you know about us? Shows you did your homework and think strategically. Executives want a view, not a description of the program.
- Which emerging risk worries you most right now, and why? Shows curiosity. Cyber, AI, third-party failures, and extreme weather are all fair answers if you can tie them to the business.
One more piece of advice. In a promotion interview years ago, I was asked how I’d handled a poor performer, and I told a long story. The interviewer stopped me: “Really, I just wanted to know that you dealt with the issue.” Answer the question first. Add the story only if they ask.
Hiring for These Roles
If you’re on the other side of the table, hire for potential and fit with your culture, not only credentials. A mix of backgrounds is a feature, not a flaw. Some of the best people I ever hired had never worked in security or continuity before.
Write the job description around outcomes, not a list of documents to maintain. If you need a starting point, our resilience job descriptions cover business continuity, crisis management, and GSOC and intelligence roles from analyst to director.
How to Move Up
The jump from manager to director isn’t about knowing more continuity. It’s about speaking the language of the business. When I was being considered for director roles, I planned a master’s degree in criminal justice. Our HR director pointed out that the leaders above me had MBAs or law degrees. I got the MBA, and my language changed from crisis management to business.
A few moves that work:
- Learn under experienced leaders. Being the only, untrained crisis person in a company is the hardest place to start.
- Get in the room for real events. Volunteer for the crisis team, the exercise control cell, or the AAR. Every activation teaches more than a course.
- Market your program. Nobody funds what they don’t understand. Make yourself important.
- Find a mentor or coach. Someone who has done the job can shorten the learning curve by years. Our coaching pairs resilience leaders with someone who has sat in their seat.
This field doesn’t need more people who can write a plan. It needs people who can lead others through the day the plan meets reality.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity and Ultimate Guide to Crisis Management.
- Learn the basics for free. Our free Crisis Management 101 and Business Continuity 101 courses are a good first step into the field.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program with us.
Crisis Management Mistakes: Identifying and Avoiding Them