[All remote jobs](https://jobicy.com/jobs.md)[![Resilience logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e67f0de9-221.png)](https://jobicy.com/company/resilience.md)[Resilience](https://jobicy.com/company/resilience.md) # Tabletop Exercise (TTX) Specialist – Cybersecurity Focus Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/resilience.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 100k–135k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceDirectorPublished11 Oct 2026Apply before10 Nov 2026Listing views62Application actions4Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. This client-facing cybersecurity role designs, tailors, and facilitates tabletop exercises that evaluate enterprise incident response, disaster recovery, and business continuity readiness. The specialist will guide executive and cross-functional stakeholders through crisis scenarios such as ransomware attacks, data breaches, and systemic security incidents. Key deliverables include exercise materials, facilitator scripts, evaluation metrics, debriefs, and actionable After-Action Reports. The position requires knowledge of US and European cyber/privacy regulations, strong project coordination, and up to 25% travel across the US and Europe. It is a high-visibility role requiring confident executive communication and ownership across multiple client engagements. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 4/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThe role combines technical cybersecurity and regulatory knowledge with independent scenario design and executive-level facilitation under simulated crisis conditions. Success depends on translating complex risk issues into practical decisions for diverse, non-technical stakeholders while managing multiple engagements. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job medianMarket rate$117,500US market range$95k–$145k0$160k AI insightThe disclosed compensation range is $100,000 to $135,000 USD, with a midpoint of $117,500 per year. This is broadly competitive for a mid-level US cybersecurity tabletop exercise and incident-response consulting specialist; estimated US market pay is approximately $95,000 to $145,000 annually depending on location, client-facing experience, certifications, and depth of incident-response expertise. ## Core skills Skills and capabilities most closely associated with this opportunity. [Cybersecurity tabletop exercises](https://jobicy.com/jobs?search_keywords=Cybersecurity%20tabletop%20exercises.md)[Incident response planning](https://jobicy.com/jobs?search_keywords=Incident%20response%20planning.md)[Business continuity planning](https://jobicy.com/jobs?search_keywords=Business%20continuity%20planning.md)[Disaster recovery](https://jobicy.com/jobs?search_keywords=Disaster%20recovery.md)[Crisis simulation facilitation](https://jobicy.com/jobs?search_keywords=Crisis%20simulation%20facilitation.md)[Executive stakeholder management](https://jobicy.com/jobs?search_keywords=Executive%20stakeholder%20management.md)[Cyber risk management](https://jobicy.com/jobs?search_keywords=Cyber%20risk%20management.md)[GDPR and privacy compliance](https://jobicy.com/jobs?search_keywords=GDPR%20and%20privacy%20compliance.md)[After-Action Reports](https://jobicy.com/jobs?search_keywords=After-Action%20Reports.md)[Project management](https://jobicy.com/jobs?search_keywords=Project%20management.md) Sample interview questionsHow do you design a tabletop exercise that is relevant to a specific client?I begin by reviewing the client's incident response, disaster recovery, and business continuity plans, along with their industry, threat profile, critical systems, and regulatory obligations. I identify decision points and gaps, then build an escalating scenario with clear injects, roles, success criteria, and evaluation metrics tied to the client's priorities. How would you facilitate a ransomware exercise with a non-technical executive team? I would use plain business language and structure the discussion around decisions executives actually own, such as operational shutdowns, legal notification, customer communications, ransom considerations, and recovery prioritization. I would keep the scenario time-bound, clarify assumptions, and ensure each function understands its responsibilities without overwhelming participants with unnecessary technical detail. What should an effective After-Action Report include? An effective AAR should summarize the exercise scope and scenario, document key decisions and observations, identify strengths and gaps, assess process and communication effectiveness, and prioritize recommendations. Each recommendation should have a clear owner, rationale, urgency, and practical next step so the report becomes an improvement roadmap rather than only a record of discussion. How do GDPR, NIS2, CCPA, and SEC disclosure requirements affect incident-response exercises? They shape the scenario's notification, evidence preservation, governance, and escalation decisions. I would incorporate realistic prompts about breach assessment, materiality, regulator and customer notification timelines, cross-border data considerations, and coordination among security, legal, privacy, communications, and executive leadership. How do you manage several client exercises with competing deadlines? I establish a delivery plan for each engagement with milestones for discovery, scenario development, stakeholder scheduling, facilitation, and reporting. I maintain a central tracker, communicate risks early, use reusable but adaptable templates, and protect review time so quality is not compromised when schedules change. Opportunity details ## About this role. About Us At Resilience, we’re creating a new category that integrates cybersecurity, cyber insurance, and cyber risk management. Founded in 2016 by experts from across the highest tiers of the US military and intelligence communities – and built by prominent leaders and innovators from the insurance, technology, and cybersecurity industries – Resilience is rewriting the rules of how cyber risk is assessed, measured, and managed. Our integrated cyber risk solutions connect risk quantification software, cybersecurity experts, and A+ rated cyber insurance, all purpose-built for middle and large organizations. We are a cybersecurity company, a Cyber and Tech E&O-focused MGA, a fintech startup, and a data science powerhouse, all purposefully built into one. Resilience is proud to be backed by leading technology investment firms, including General Catalyst, Lightspeed Venture Partners, Intact Ventures, Founders Fund, CRV, and Shield Capital. The Hook: Why this role matters now Step into a high-visibility, client-facing role to drive real-world cyber resilience for middle to large enterprises with annual revenues ranging from $100M to $10B. Reporting to the Director of Security and Risk Services, as a Tabletop Exercise (TTX) Specialist, you won’t just run routine drills; you will take complete ownership of designing, building, and facilitating immersive, crisis-level cyber incident simulations. You will serve as the trusted advisor who tests client Incident Response Plans (IRPs), Disaster Recovery Plans (DRPs), and Business Continuity Plans (BCPs), ensuring executive teams are battle-tested before a real threat strikes. The Mission: What you will achieve in the first 6 months In your first six months, you will take full accountability for building, tailoring, and facilitating realistic TTX scenarios that test our clients’ operational and strategic cyber readiness: * Scenario Design & Engineering: Partner with Resilience Customer Engagement teams to audit client Incident Response Plans, identify critical coverage gaps, and author tailored exercise guides, facilitator scripts, and evaluation metrics mapped to each client’s industry and regulatory requirements. * Executive & C-Suite Facilitation: Confidently lead virtual and in-person TTX sessions, guiding cross-functional stakeholders—including non-technical executive leadership (C-Suite, Legal, PR, and HR)—through complex decisions during simulated ransomware attacks, data breaches, and systemic security events. * Post-TTX Analysis & Actionable Guidance: Conduct debriefing sessions and deliver comprehensive After-Action Reports (AARs) summarizing lessons learned, regulatory decision-making nuances, and actionable security recommendations. * Methodology Scaling: Contribute to refining Resilience’s proprietary TTX frameworks, methodologies, and best practices as our client portfolio grows globally. The Toolkit: Technical skills vs. “nice-to-haves” * Core Requirements: 3–5 years of proven experience designing and facilitating cybersecurity incident response TTXs, IRPs, DRPs, and BCPs for enterprise clients. * Demonstrated mastery in facilitating crisis simulations for cross-functional enterprise stakeholders, specifically non-technical C-Suite executives, Legal, PR, and HR leaders. * Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field (or equivalent practical experience). * Strong working knowledge of major US and European cybersecurity and privacy regulations (GDPR, NIS2, CCPA, SEC cyber disclosure rules) and their impact on incident response governance. * Strong project management skills to handle multiple client engagements, coordinate enterprise schedules, and meet strict deadlines * Willingness to travel up to 25% across the US and Europe * Nice-to-Haves: Relevant industry certifications (e.g., CISSP, CISM * Hands-on proficiency with specialized TTX simulation platforms and software. The Culture: How we work We move fast, operate with zero ego, and embrace a bias to action. We are guided strongly by our four core values: transparency, excellence, grit, and humility. You will thrive in an exciting, collaborative startup culture alongside top-tier cybersecurity experts, maintaining a constructive learning environment for clients under pressure. The Benefits: Standardized perks You will work alongside prominent leaders and innovators from the insurance, technology, and cybersecurity industries, as well as experts from the highest tiers of the US military and intelligence communities. Compensation range $100,000—$135,000 USD What Resilience Offers You Innovative company culture Flexible work schedules Family paid leave Paid healthcare for employees 401k/Pension Professional development & career advancements Flexible paid time off Employee referral bonus Accommodations and Accessibility We want to ensure you’re able to perform as well as possible in your interview. As part of that, if you have any accessibility-related needs to ensure a comfortable visit, please let us know. We’ll do our best to provide reasonable accommodations to suit your working style during your interview and if you join our team. If you require a reasonable accommodation in completing this application, interviewing, completing any pre-employment testing, or otherwise participating in the employee selection process, please let your recruiter contact know. Beware of Job Scams Resilience is excited to welcome talented individuals to explore career opportunities with us. However, we urge you to stay vigilant against recruitment scams where fraudsters may impersonate our company. We will never ask for payments, conduct interviews via chat rooms, or contact candidates from personal email accounts. All job applications must be submitted through our official platform at [greenhouse.io](http://greenhouse.io) , and interviews will only take place via approved Resilience accounts. If you receive suspicious outreach or have concerns, please let your recruiter contact know. Thank you for helping us maintain a safe and secure recruitment process. Show more [Apply now >](https://jobicy.com/jobs/154999-tabletop-exercise-ttx-specialist-cybersecurity-focus.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Oct 11 New ### [Senior / Staff Intelligence Analyst, Environmental Crimes](https://jobicy.com/jobs/155032-senior-staff-intelligence-analyst-environmental-crimes.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![Databricks logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/12/4e3f864ba9cf3c62d471e1c62414d098.jpg) Databricks Oct 11 New ### [Staff Security Engineer, Incident Response](https://jobicy.com/jobs/155021-staff-security-engineer-incident-response.md) RDQ327R180 Staff Security Engineer, Incident Response The Incident Response team’s mission is to respond to security threats, incidents and investigations to protect our customers, employees and enterprise data in a… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Oct 11 New ### [Blockchain Security Expert – Chain Security Evaluation Track](https://jobicy.com/jobs/152970-blockchain-security-expert-chain-security-evaluation-track.md) About You You’re a self-starter who thrives on tackling the toughest and most meaningful problems, even if they are the most difficult problems. You’re comfortable with the unknown and understand… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Oct 11 New ### [Blockchain Security Expert Intern – AI Track](https://jobicy.com/jobs/152979-blockchain-security-expert-intern-ai-track.md) About the Company Founded in 2018 by professors of Yale University and Columbia University, CertiK is a pioneer in blockchain security, utilizing best-in-class AI technology to secure and monitor blockchain… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Oct 11 New ### [Blockchain Security Expert – Security Audit Track](https://jobicy.com/jobs/152975-blockchain-security-expert-security-audit-track.md) About You You’re a self-starter. You believe in tackling the most important problems, even if they are the most difficult problems. You’re comfortable with the unknown and understand that #startuplife… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Oct 11 New ### [Blockchain Security Expert – Anti Defect Track](https://jobicy.com/jobs/152966-blockchain-security-expert-anti-defect-track.md) About the Company Founded in 2018 by professors of Yale University and Columbia University, CertiK is a pioneer in blockchain security, utilizing best-in-class AI technology to secure and monitor blockchain… * ![Synthesia logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/c69aad11-221.webp) Synthesia Oct 11 New ### [SecOps Security Engineer (Staff-level, L6)](https://jobicy.com/jobs/152968-secops-security-engineer-staff-level-l6.md) Synthesia is the world’s leading AI video platform for business, used by over 90% of the Fortune 100. Founded in 2017, the company is headquartered in London, with offices and… * ![Vercel logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/a6aded72-221.png) Vercel Oct 10 New ### [Security Engineer, Cloud](https://jobicy.com/jobs/152929-security-engineer-cloud.md) About Vercel: Vercel is the agentic infrastructure company. We free people and agents to ship what’s next. For more than a decade, Vercel has shaped how the web is built…. * ![Nebius logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/d90c0566-221.webp) Nebius Oct 10 New ### [Detection Engineering & Response Lead](https://jobicy.com/jobs/148918-detection-engineering-response-lead.md) About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from… * ![Tremendous logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/01/c2bd8be5-221.jpeg) Tremendous Oct 10 New ### [Head of Security](https://jobicy.com/jobs/152862-head-of-security.md) Tremendous is the global platform built for businesses to send payouts—gift cards and money—to anyone, anywhere, instantly. We’re trusted by 20,000+ organizations, from startups to giants like Atlassian, MIT, and… [Browse all jobs](https://jobicy.com/jobs.md)