Disaster Recovery Journal Summer 2025

CAREER SPOTLIGHT Career Spotlight: Jason Harrell

to help bolster our cyber assess ment recommendations, the link between cyber risk and business continuity has always been strong. The indus try has grown immensely,

Tell us about yourself – your name, company, title, and responsibilities? My name is Jason Harrell. I am a thought leader within the cybersecurity risk management and non-financial risk public policy space. Over the last 25 years, I have held numerous roles as both a director and executive within informa tion technology, cybersecurity, and public policy/advocacy. In my last role, I was responsible for developing and execut ing a public policy and advocacy strategy for cybersecurity, operational resilience, third party/supply chain management, and emerging technology. My career superpower has been the ability to build new functions within organizations that enhance resilience and manage risks. How did you get into the business continuity industry? I was a young network engineer when my boss, concerned about the different email viruses, asked me to provide a solution for developing alternate network

and with the emer gence of operational resilience

league who helped me better understand regulatory engagement and together, we were able to build a policy and advocacy function to increase the engagement on a global scale and allowed our organiza tion to be a part of the financial sector dialogue on numerous non-financial risk areas. What are some lessons learned you still leverage today? Having worked for systemically important financial institutions and market utilities (SIFI/

as a regulatory priority, the connective tissue between these areas has increased. As my work continues, our primary focus is to determine how to best prepare for severe-but-plausible operational events. Tell us about some of the challenges you have encountered in your career? The biggest challenge I’ve encoun tered was expanding my skillset from an information technology and cyber profes sional to a public policy and advocacy professional. When executive manage

connectivity in the event our primary internet con nection was unavailable. We didn’t call it business continuity then, but it was the first time I can remem ber having to consider business workarounds of this kind. Since that time, my work has increasingly required partnerships

SIFMU), investment banking, investment management, cus todian, clearing/settlement, and trading venue organiza tions, I have gained a broad understanding of the financial markets; different approaches to managing cyber risks; and

Join Jason Harrell at DRJ Fall 2025 in Dallas “Between Operational Resilience, DORA, and the Deep Blue Sea” This presentation will introduce the Digital Operational Resilience Act (DORA), a groundbreaking regulatory framework designed to enhance the resilience of financial entities within the European Union. DORA aims to establish robust standards for digital operational resilience, addressing the challenges posed by cyber threats, technological failures, third party and supply chain, and other disruptions.

how different risk failures may impact these organiza tions and financial markets. I use what I have learned every time I engage in policy discussions or when I think about the best policy approaches and risk outcomes across the financial services sector. Each of these subsectors have different risks and needs. There are no one-size fits all solutions.

ment called on me to develop an internal function to increase our partnership with the financial sector, it was intimidating. While I understood cyber and cyber solu tions, I had no idea how to convert this into a policy and advocacy function. I was fortunate to be paired with a col

with my business continuity colleagues. Whether it was to understand the busi ness impact assessment of applications and processes to prioritize application penetration testing, threat assessment, or other risk management activities or

DISASTER RECOVERY JOURNAL | SUMMER 2025 25