Manager, Continuity & Response

Clio is the global leader in legal AI technology, empowering legal professionals and law firms of every size to work smarter, faster, and more securely. We are transforming the legal experience for all by bettering the lives of legal professionals while increasing access to justice.

This role sits within Clio's Security and Compliance organization and owns the programs that keep Clio resilient when things go wrong: incident management and disaster recovery. It's a cross-cutting function — you'll work cross functionally with Production Engineering, Corporate Security, IT, Communications, and product teams to make sure that when an incident or disaster hits, Clio responds fast, recovers cleanly, and gets better afterward.

This is a program you'll have the opportunity to improve, own and shape.

As Manager, Continuity & Response you oversee Clio's Business Continuity program to ensure readiness and response capabilities are active, tested, and up-to-date. You will be collaborating with other leaders across the organization to improve the incident management and disaster recovery programs end-to-end: the tooling, plans, exercises, tests, metric definitions, and follow-through that turns lessons into durable improvements. You are a coordinator and a program leader — your job is to make sure the right people, playbooks, and structures are in place so that when Clio is under pressure, the response is fast, calm, and effective.

This is a Manager level role at Clio and it carries manager-level scope and accountability: you own a roadmap, you drive outcomes that show up in company results, you are the voice of resilience with senior partners, and you bring clarity to ambiguous, high-pressure situations. You'll stay hands-on — designing tabletop scenarios, configuring incident tooling, and analyzing incident data — while operating with the judgment, decision-making framework, and cross-functional influence expected of a manager.

• Design and run tabletop exercises — departmental, team-specific, and scenario-specific — from writing the scenario and injects through facilitation, and capture the gaps they surface.
• Turn lessons into action — convert findings from tabletops, DR tests, and real incidents into action plans, drive them to completion with the owning teams, and hold the loop closed.
• Keep disaster recovery current — ensure DR plans, recovery tiers, RTO/RPO targets, and runbooks keep pace with Clio's evolving architecture.
• Coordinate and lead DR tests — assist in scheduling and overseeing failover and recovery exercises, documenting results, and circulate reports for review and executive approval.
• Manage the incident management tooling — administer the incident management platform: define incident types, severities, response flows, escalations, roles, and automations.
• Own the incident metrics — track and interpret incident statistics and trends (frequency, time-to-detect/resolve, effort distribution, recurrence), surface where time is being spent well or poorly, and identify redundancies and process changes that make response more effective.
• Own and defend the resilience roadmap — propose improvements, sequence the program, and educate leadership and partner teams on why it's the right thing to invest in.
• Be the connective tissue in a crisis — bring structure and clarity to live incidents and crisis-management escalations using the Incident Command structure.
• Partner on cyber resilience — work with Security, IT, and Production Engineering on recovery and resilience planning scenarios.
• Leverage AI effectively — use AI to assist and accelerate your objectives, modelling good, effective AI use for the teams you collaborate with.
• Communicate for trust —…