Senior Lead Business Resiliency Exercise Consultant

Enterprise Exercise Professional

Wells Fargo is seeking a seasoned and strategic exercise professional with a proven track record in designing, executing, and evaluating high-impact enterprise exercises. This role emphasizes a comprehensive approach to operational resilience, with a focus on cybersecurity, enterprise critical service/products, and third-party provider (TPP) risk.

We are looking for an innovative exercise leader who can integrate business, technology, and operational requirements into enterprise-wide exercises that rigorously test and enhance critical capabilities, decision-making, response readiness, and recovery strategies.

This senior-level practitioner will be responsible for developing and executing a scalable, enterprise-aligned exercise framework that addresses systemic risks across cyber threats, critical business services, and third-party dependencies. The role includes ownership of the end-to-end coordination and delivery of these exercises as part of the Enterprise Resiliency Exercise Office's (EREO) broader mission to strengthen the organization's resilience posture.

In this role, you will:

• Lead the design and execution of enterprise-wide cyber and operational resilience exercises, ensuring alignment with the company's strategic objectives.
• Develop and implement a comprehensive exercise framework that integrates cybersecurity, enterprise-critical services/products, and third-party provider (TPP) risk domains to validate business continuity and operational resilience capabilities across the enterprise.
• Own the end-to-end lifecycle of enterprise exercises, including design, development, facilitation, and evaluation, with a focus on high-impact scenarios that test systemic risk exposure and organizational readiness across cyber, enterprise-critical services/products, and third-party ecosystems.
• Drive strategic planning and maturity roadmap development to continuously enhance the organization's resilience posture, including the validation of continuity capabilities for services delivered by internal teams and external third parties, with a strong emphasis on cybersecurity and enterprise-critical operations.
• Design and manage Master Scenario Event Lists (MSELs), injects, control elements, and evaluation criteria for operations-based exercises that simulate real-world disruptions across cyber, business, and third-party domains.
• Facilitate cross-functional, discussion-based exercises involving key stakeholders such as Enterprise Business Resiliency Leadership, Resiliency Leads, Business Owners, Line of Business Relationship Managers, Supplier Management, and external service providers, with scenarios that span cyber threats, enterprise-critical services, and third-party dependencies.
• Lead post-exercise analysis and debriefs, guiding participants in identifying gaps, vulnerabilities, and key findings, and translating these into actionable recommendations across cyber, enterprise-critical, and third-party domains.
• Produce high-quality, executive-level facilitation guides, briefings, and supplemental materials using Microsoft Office tools (Word, PowerPoint, etc.)
• Generate comprehensive After-Action Reports (AARs) that capture lessons learned, strategic insights, and prioritized recommendations to strengthen enterprise resilience across cybersecurity, critical services/products, and third-party operations.
• Present findings and strategic recommendations to senior leadership, highlighting opportunities for investment and improvement across cyber, operational, and third-party domains.
• Ensure timely delivery and quality of all exercise documentation and artifacts, meeting internal standards and regulatory expectations.
• Lead follow-up workshops or targeted exercises to address critical findings and reinforce resilience capabilities across cyber, enterprise-critical services/products, and third-party providers.
• Analyze exercise outcomes to identify enterprise-wide resilience risks, and proactively inform enhancements to cybersecurity, critical service, and TPP resilience strategies.
• Serve as a trusted advisor to business and technology leaders, providing insights and recommendations that drive performance and resilience across the enterprise, with a focus on cyber, enterprise-critical, and third-party domains.
• Support Risk and Control Self-Assessments (RCSAs) by identifying and evaluating risks and controls related to cyber, operational, and third-party resilience.
• Respond to internal audits and regulatory inquiries related to enterprise exercises, ensuring transparency and compliance with resilience standards across cyber, enterprise-critical services/products, and third-party testing.
• Lead the resolution of complex business execution challenges, delivering scalable, long-term solutions that enhance the effectiveness of the enterprise exercise program across all three domains.
• Provide strategic direction and thought leadership in the development of a robust, cross-organizational exercise capability that spans internal operations, cybersecurity, enterprise-critical services/products, and third-party dependencies.
• Facilitate decision-making and implementation of exercise strategies through regular engagement with cross-functional teams and leadership forums.
• Engage with stakeholders across all levels of the organization, serving as a subject matter expert in enterprise resilience, cybersecurity preparedness, and third-party risk management.
• Contribute to the development of a strategic scenario library, ensuring alignment with emerging threats, evolving business priorities, and regulatory expectations across cyber, enterprise-critical, and third-party domains.

Required Qualifications:

• 7+ years of Business Execution, Implementation, or Strategic Planning experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education.

Desired Qualifications:

• Advanced academic credentials with extensive experience leading enterprise-wide initiatives in cybersecurity, business continuity, and resiliency, especially in environments involving third-party dependencies and enterprise-critical services/products.
• Proven leadership in the financial services sector, with deep expertise in managing cybersecurity and business continuity exercises that span internal functions and third-party providers supporting enterprise-critical services/products.
• Demonstrated success in assessing and managing risk and control frameworks across complex ecosystems, including those involving third-party relationships, enterprise-critical services/products, and cybersecurity vulnerabilities.
• Strategic change agent with a history of driving transformation across large organizations, aligning cybersecurity and resiliency goals with business priorities and third-party risk landscapes.
• Extensive experience in designing and executing large-scale exercises that simulate disruptions to enterprise-critical services/products, incorporating cybersecurity threats and third-party failure scenarios.
• Deep understanding of the financial services industry, including regulatory expectations and operational interdependencies with third-party providers and critical service/product delivery.
• Demonstrable expertise in the design, facilitation, and coordination of complex exercises involving senior leaders across business functions and external third-party stakeholders, with a focus on cybersecurity and operational continuity of enterprise-critical services/products.
• Exceptional communicator with the ability to tailor messaging for executive audiences, technical teams, and external stakeholders, especially in high-stakes scenarios involving third-party risk and cybersecurity incidents affecting enterprise-critical services/products.
• Proven ability to operate effectively in fast-paced, dynamic environments, exercising independent judgment in developing methodologies and evaluation criteria for enterprise-wide impact.
• Deep familiarity with industry-standard exercise methodologies, including Homeland Security Exercise and Evaluation Program (HSEEP), NIST SP 800-84, and FFIEC Business Continuity Management, with practical application to third-party and cybersecurity scenarios involving enterprise-critical services/products.
• Track record of building and scaling exercise programs that address high-priority threats and risks to enterprise-critical services/products, including those delivered by third-party providers and vulnerable to cybersecurity threats.
• Experience in developing, implementing, and monitoring exercise program controls and performance metrics, ensuring alignment with enterprise risk appetite and regulatory requirements.

Job Expectations:

• Candidate must be based out of Wells Fargo, Charlotte, Brigham Building location (Ballantyne). and will be required to work in the office location (Charlotte), as per organization's In Office Adherence / Return to Office (RTO) at a minimum of 3 days per week.
• Ability to work weekends supporting an exercise, if needed.
• Deliver high quality, strategic work in accordance with aggressive timelines.
• Demonstrate and support processes and controls that govern our work.
• Build trust and rapport with colleagues across all levels of the organization.
• Be an effective advocate for your team.
• Team player who is great at execution, proactively collaborates across the organization, and possesses strong influencing skills.
• The individual is agile, proficient in navigating complex organizations.

The exercise practitioner should have experience across the following key exercise disciplines:

• Business Continuity Planning Methodologies: Business Impact Analysis (BIA), Risk Assessment, and Recovery Strategy Development.
• Cyber Security: Advanced knowledge and insights of cyber security fundamentals and industry guidance. Technical cyber exercise design, development, and execution.
• Operational Resilience: Experience with and vast knowledge of Bank of England'