Business Continuity Manager
Business Continuity Manager in Kenya represents an essential professional discipline powering operational capability and strategic excellence across modern organizations. Practitioners navigate evolving regulatory standards, data-driven software tools, and dynamic economic models to deliver measurable institutional results across East Africa. In the Kenyan context, practitioners must adhere to national statutory frameworks, professional codes of ethics, and industry best practices established by relevant regulatory authorities. Career advancement in Kenya typically rewards demonstrated operational reliability, enabling experienced professionals to transition into senior supervisory, quality assurance, or independent technical consulting roles across commercial and public enterprises.
The short answer
- Will AI take it
- 46 out of 100, moderate exposure. About 50% of the tasks still need a person.The detail
- Is anyone hiring
- Hiring is growing, with net demand +15% over 2024-2030.The detail
- What it pays
- Starts around KES 60k a month and reaches KES 700k at senior level.The detail
- How to get in
- KCSE C+ (Bachelor Degree) is the usual minimum, and 8 courses in the catalogue lead to it. About 7 years to a lead role.The detail
The role
What the work is, what it pays, and what it asks of you.
Overview
In the Kenyan context, practitioners must adhere to national statutory frameworks and industry best practices established by relevant regulatory authorities. Employers increasingly prioritize candidates who demonstrate verified technical qualifications, continuous professional development, and practical field competence. Employers increasingly prioritize candidates who demonstrate verified technical qualifications, continuous professional development, and practical problem solving competence. Structured cross-functional collaboration and ongoing professional certification ensure long-term career resilience and high operational productivity across East African markets.
Career advancement in Kenya typically rewards demonstrated operational reliability, enabling experienced professionals to transition into senior supervisory, quality assurance, or independent technical consulting roles across commercial and public enterprises. Emerging technological innovations across Kenyan industrial sectors continue to transform day to day operational workflows, elevating demand for skilled personnel who combine fundamental mastery with modern digital tool proficiencies. Practitioners frequently liaise with statutory regulatory commissions and local enterprise leadership to guarantee that all operational methodologies comply with national safety and quality mandates.
Work environment
- Work environment
- Primarily office based in nairobi headquarters of banks, telecom companies, and large corporates , safaricom's westlands campus, equity bank's upper hill tower, kcb's kencom house. most bcp managers work from corporate head offices with periodic travel to branch locations and data centres across kenya. during crisis events or bcp exercises, work may shift to incident command centres or alternate recovery sites. travel to branch offices in mombasa, kisumu, eldoret, and other major towns for bcp audits and training is common , typically 3 5 days per month. international organisations (un offices in gigiri, ngos) may require travel to field locations in arid and semi arid areas. remote work is possible for planning and documentation tasks but crisis response requires on site presence. during actual disruptions (power outages, political unrest, cyber incidents), expect extended hours and weekend work.
- Work style
- Highly analytical and detail oriented , must think systematically about failure scenarios and interdependencies. Calm under pressure is essential; BCP managers are most visible during crises when clear headed decision making is critical. Strong project management skills to drive BCP programmes across reluctant departments. Excellent communication and persuasion skills , must convince senior leadership to invest in continuity measures that may never be 'used.' Stakeholder management across IT, operations, HR, security, and executive teams. Methodical and documentation driven , BCP plans must be precise and testable. Comfortable with ambiguity and scenario planning. Risk aware mindset with ability to balance operational resilience against cost. Presentation skills for board level reporting.
- Physical demands
- Low physical demand, predominantly seated work in office or remote environments with prolonged computer and screen interaction.
- Travel
- Minimal travel, primarily localized to quarterly team planning sessions and occasional stakeholder summits.
- Remote working
- Remote friendly
- Freelance potential
- Medium
A day in the role
The morning starts with reviewing a business impact analysis for a global bank's payment processing systems, identifying recovery time objectives for each critical function. A mid-morning meeting with the IT disaster recovery team covers cloud backup restoration test results from the previous night's simulation. After lunch, the manager facilitates a tabletop exercise with the crisis management team, simulating a ransomware attack on corporate systems. Observations and gaps are documented for plan revision and shared with senior leadership. You coordinate closely with cross functional colleagues to align on immediate deliverables, double checking equipment readiness and standard operating protocols. Throughout the shift, you document system performance metrics, consult with operational supervisors on technical exceptions, and uphold rigorous occupational health and environmental safety protocols.
In the afternoon, you execute core deliverables, consult with cross functional colleagues, document operational outcomes, and ensure that all equipment and handover notes are fully updated before completing the shift. Before completing the shift, you reconcile physical logs, review operational checklists with the oncoming team, archive incident reports, and brief project supervisors on task completion.
What it pays
Kenyan market salary bands, monthly in KES- Entry level
- KES 60k – 120k
- Mid-level specialist
- KES 150k – 300k
- Senior / lead
- KES 350k – 700k
Monthly pay in Kenyan shillings, rounded to the nearest thousand. The shaded band is the distance between entry and senior pay, which is the part that is changing. These are projections, not observations.
The trade-offs
| In its favour | Against it |
|---|---|
| High job security , BCP is becoming mandatory for regulated industries in Kenya (banking, insurance, telecom) | High stress during actual crises , extended hours, weekend work, and high-stakes decision-making under pressure |
| Cross-functional exposure , work with IT, operations, HR, security, and executive leadership across the entire organisation | Often seen as a cost centre , constant battle for budget and resources, especially in non-regulated industries |
| Meaningful impact , your work directly determines whether an organisation survives a major disruption | Can be lonely , many organisations have only one BCP manager, limiting peer collaboration internally |
| Growing field with relatively few certified professionals in Kenya , low competition for senior roles | Certification costs are high , DRII CBCP and ISO 22301 courses require significant investment (KES 150,000-250,000 each) |
In practice
Business continuity managers develop and manage plans to ensure organisations can continue critical operations during and after disruptions, natural disasters, cyberattacks, power outages, political unrest, pandemics or supply chain failures. They combine risk assessment, crisis management planning, IT disaster recovery and organisational resilience expertise. Professionals in this field work across banking, healthcare, telecommunications, manufacturing and government sectors worldwide. They conduct business impact analyses, define recovery time and recovery point objectives, design continuity frameworks aligned to ISO 22301, and run tabletop exercises and full-scale drills. The role is the same worldwide whether working locally, remotely, or on an H1B visa, as core skills and procedures are identical. Career progression leads to senior continuity manager or head of resilience.
Core responsibilities include conducting business impact analysis (bia), identifying critical functions, rtos, rpos and dependencies, operational coordination, and ensuring strict adherence to Kenyan statutory frameworks and quality standards.
Kenya's BCP market is driven by regulatory requirements and real operational risks. CBK mandates operational resilience frameworks for all licensed banks, 44+ banks need BCP expertise. IRA requires insurers to maintain BCPs. Telecom regulators require critical infrastructure resilience. Key employers: Safaricom (largest BCP team in Kenya), Equity Bank, KCB, Cooperative Bank, Standard Chartered, Absa, UN agencies (UNEP, UN-Habitat in Gigiri), international NGOs, KPLC, Kenya Airways. Real risks keep this field relevant: election-cycle violence (2007-2008 was a watershed moment for Kenyan BCP), terrorism (Westgate 2013, Dusit 2019), flooding (Nairobi, western Kenya), power instability (KPLC grid failures), cyber threats (ransomware attacks on Kenyan banks). ISO 22301 certification is growing, several Kenyan banks and telecoms are pursuing or maintaining certification. The field is small but tight-knit; reputation matters enormously.
Business Continuity Manager Specialist, Senior Business Continuity Manager, Business Continuity Manager Lead, Business Continuity Manager Consultant
Exposure
How much of this a machine can already do, and how that was determined.
Where this rating sits
3,562 rated careers| Score | Careers |
|---|---|
| 0 to 4 | 29 |
| 5 to 9 | 22 |
| 10 to 14 | 116 |
| 15 to 19 | 290 |
| 20 to 24 | 542 |
| 25 to 29 | 297 |
| 30 to 34 | 305 |
| 35 to 39 | 195 |
| 40 to 44 | 253 |
| 45 to 49 | 279 |
| 50 to 54 | 264 |
| 55 to 59 | 156 |
| 60 to 64 | 101 |
| 65 to 69 | 130 |
| 70 to 74 | 128 |
| 75 to 79 | 151 |
| 80 to 84 | 163 |
| 85 to 89 | 86 |
| 90 to 94 | 54 |
| 95 to 99 | 1 |
Rated above 61% of the 3,562 careers in the catalogue, which averages 43. Inside business the mean is 58, across 487 careers.
What the rating is made of
Share of recorded tasks- Machine does it15%
- Software can already complete this work end to end.
- Machine assists35%
- A person still decides, but the drafting is done for them.
- Person does it50%
- Judgement, relationships and accountability that do not transfer.
Named task by task
Already automated
- AI-powered risk scenario generation from threat intelligence and historical incident data
- Automated business impact analysis (BIA) data collection and processing
- AI-assisted disaster recovery plan testing and gap identification
- Predictive threat monitoring with real-time alert generation
- AI-orchestrated DR runbook automation and continuous dependency mapping
Still human
- Conducting business impact analysis (BIA), identifying critical functions, RTOs, RPOs and dependencies
- Developing business continuity plans, documenting procedures for maintaining operations during disruptions
- Organising and facilitating BCP exercises, tabletop exercises, simulation drills, full-scale recovery tests
- Coordinating crisis management, establishing crisis teams, communication protocols, decision-making frameworks
- Ensuring regulatory compliance, CBK operational resilience, IRA business continuity, ISO 22301 certification
- Training staff, raising awareness, conducting drills, ensuring all staff know their roles during disruptions
| Already automated | Still human |
|---|---|
| AI-powered risk scenario generation from threat intelligence and historical incident data | Conducting business impact analysis (BIA), identifying critical functions, RTOs, RPOs and dependencies |
| Automated business impact analysis (BIA) data collection and processing | Developing business continuity plans, documenting procedures for maintaining operations during disruptions |
| AI-assisted disaster recovery plan testing and gap identification | Organising and facilitating BCP exercises, tabletop exercises, simulation drills, full-scale recovery tests |
| Predictive threat monitoring with real-time alert generation | Coordinating crisis management, establishing crisis teams, communication protocols, decision-making frameworks |
| AI-orchestrated DR runbook automation and continuous dependency mapping | Ensuring regulatory compliance, CBK operational resilience, IRA business continuity, ISO 22301 certification |
| — | Training staff, raising awareness, conducting drills, ensuring all staff know their roles during disruptions |
Your skills, sorted
13 skills recordedBeing absorbed
- Manual BIA data collection and processing
- Routine DR plan documentation and formatting
- Standard compliance reporting from templates
Worth more with the tools
- Risk scenario generation and threat modelling
- DR plan testing and gap identification
- Predictive threat monitoring and alerting
- Dependency mapping and impact analysis
Holding their value
- Crisis management coordination and leadership
- BCP exercise facilitation and staff training
- Regulatory compliance and stakeholder negotiation
- Cross-departmental coordination during disruptions
The six things it was scored on
0 to 100 each- Regulatory stakeslowers exposure
- 80
- People and inventionlowers exposure
- 65
- Digital surfaceraises exposure
- 60
- Rule bound thinkingraises exposure
- 45
- Routine intensityraises exposure
- 35
- Physical presencelowers exposure
- 30
Where a named person has to carry the liability.
Work that needs trust, persuasion or an original idea.
How much of the work already happens inside software.
Decisions that follow a procedure rather than a judgement.
How much of it repeats in the same shape each time.
Work that has to happen in a place, with hands.
Task counts
- Tasks recorded
- 11
- Automatable now
- 3
- Still human
- 7
- Displacing
- Manual BIA data collection and processing,Routine DR plan documentation and formatting,Standard compliance reporting from templates
- Augmenting
- AI risk scenario generation improves planning quality,Automated BIA data collection saves significant time,AI-orchestrated DR enables continuous monitoring vs annual testing,Predictive threat monitoring enables proactive response
- Creating
- AI-integrated operational resilience roles requiring data analytics skills,Predictive resilience positions combining AI monitoring with crisis management
Sources
Behind the ratingGetting in
The routes into the role, credentials, and tools required.
What to study
8 courses- Certificate in Credit ManagementKsh 24,000a year
- Certificate in Corporate DiplomacyKsh 36,500a year
- Diploma in Social EntrepreneurshipKsh 56,400a year
- Certificate in Social EntrepreneurshipKsh 60,000a year
- Diploma in Cooperative ManagementKsh 67,100a year
- Artisan in Office Assistance Level Four (TVET-CDACC)Ksh 67,189a year
- Artisan in StorekeepingKsh 67,189a year
- Artisan in Supply Chain ManagementKsh 67,189a year
How people get in
BSc/BCom + DRII certification + BCP experience
5-7 yearsHigh cost
BSc or BCom from UoN, KU, Strathmore or USIU plus DRII CBCP certification and experience in risk management or IT operations
IT operations + BCP specialisation
5-8 yearsMedium cost
Build IT operations or security experience, then specialise in business continuity through DRII certification and on-the-job BCP work
Industry certifications
6 verified credentialsDRII CBCP (Certified Business Continuity Professional)
Disaster Recovery Institute International (DRII)Ksh 180,0003 monthsRequired
ISO 22301 Lead Implementer
Bureau Veritas Kenya / SGS Kenya / BSI GroupKsh 150,0001 months
ISO 22301 Lead Auditor
Bureau Veritas Kenya / SGS KenyaKsh 160,0001 months
DRII MBCP (Master Business Continuity Professional)
Disaster Recovery Institute InternationalKsh 250,0006 months
CRISC (Certified in Risk and Information Systems Control)
ISACA (via local chapters in Nairobi)Ksh 120,0004 months
ITIL Foundation
ITIL accredited training providers in Nairobi (Dimension Data, Liquid Telecom)Ksh 60,0001 months
Tools of the trade
8 core toolchains- Fusion Risk Systems
BCM PlatformEssentialPaid
- Sungard Availability Services
BCM PlatformEssentialPaid
- Google Workspace (Docs, Sheets, Forms)
DocumentationEssentialFree
- Microsoft 365 (SharePoint, Teams, OneDrive)
DocumentationEssentialPaid
- BCPlanner
BCM PlanningEssentialPaid
- ResilienceONE
BCM PlatformEssentialPaid
- Microsoft Visio
Process MappingEssentialFree
- Tableau
Data VisualisationEssentialPaid
Who hires
6 verified employersInterview preparation
3 curated questionsWhat is the difference between RTO and RPO, and how would you set these for a bank's core banking system?
TechnicalMid
Be prepared to explain the difference between RTO (Recovery Time Objective) and RPO (Recovery Point Objective) with examples from Kenyan banking context.
How would you conduct a Business Impact Analysis for a telecom company like Safaricom?
TechnicalMid
Walk through a BIA methodology , identify critical business functions, assess impact of disruption, determine recovery priorities.
A major power outage hits Nairobi affecting your organisation's data centre. Walk me through your crisis response plan.
TechnicalSenior
Reference Kenya-specific risks: election cycles, al-Shabaab threats, flooding, power grid instability. Show structured crisis management approach.
Common misconceptions
Business continuity is just having a backup server and an evacuation plan
BCM covers ransomware recovery, supply chain disruption, pandemic protocols, regulatory reporting timelines, and key-person dependencies. A full BCM program includes business impact analysis, recovery time objectives per process, and crisis communication plans tested through tabletop exercises.
If you have a plan on paper, you are prepared
Untested plans fail under stress. BCM managers run quarterly tabletop exercises and annual full-scale drills, because plans written in calm conditions routinely break when people are panicking, systems are down, and stakeholders are demanding answers simultaneously.
Continuity planning is only relevant for large enterprises
SMEs are statistically more vulnerable to disasters because they lack redundant systems and cash reserves. A fire or ransomware attack that a Fortune 500 company absorbs can bankrupt a 50-person firm. BCM for SMEs focuses on rapid recovery and insurance alignment.
Professional bodies & associations
- Kenya Institute of Management (KIM)
- Institute of Certified Public Accountants of Kenya (ICPAK)
What happens next
How the role evolves from here, and where it leads.
How the role changes
2024-2030AI shifts BC/DR from reactive recovery to predictive resilience. AI augments scenario generation, BIA and monitoring but crisis management, exercises and regulatory compliance remain human. Most organisations' DR plans are years behind AI adoption.
- 2024already here
AI risk scenario and BIA tools adopted by leading Kenyan banks.
- 2027projected
AI-orchestrated DR with continuous monitoring replaces annual testing cycles.
- 2030projected
Predictive resilience becomes standard, with managers focusing on crisis leadership and compliance.
The near term
2026-2028Low disruption
AI is a productivity helper, not a threat, through 2028, the human core of the work is unchanged.
- Tasks automated by 2028
- 22%
- Practitioners augmented
- 47%
- Displacement risk
- 8%
- New roles created
- 17%
- AI mainly automates documentation and admin
- Core hands-on/empathic work unchanged
- Productivity gains without displacement
- Demand stable to growing with sector trends
- Tools like Finnomena Resilience boost efficiency
- WEF Future of Jobs Report 2025, 2025-2030 labour-market outlook (~22% structural churn)
- Stanford HAI AI Index Report 2025, enterprise AI adoption & task automation trends
- McKinsey 'The State of AI' (2024/2025), activity-level automation potential
- OpenAI/UPenn 'GPTs are GPTs' (2023) + 2024 follow-ups, occupational LLM exposure
Market outlook
- Net demand, 2024-2030
- +15%
- Demand
- 65 of 100
- Supply pressure
- 3 of 100
- Balance
- Growing demand, limited supply
- Regulatory requirements (CBK, IRA operational resilience)
- Increasing cyber threats requiring recovery planning
- Climate change increasing disaster frequency
- Post-COVID-19 BCP awareness
- Political risk management needs
- BCP often viewed as compliance overhead
- Limited budget for exercises and testing
- Difficulty maintaining plans current
- Low board-level awareness in some organisations
How to stay ahead
Study risk management, business continuity, IT or security (BSc/BCom from UoN, KU, Strathmore, USIU)
Learn business continuity methodology, BIA, BCP development, crisis management, disaster recovery, ISO 22301 standard
Study IT disaster recovery, backup strategies, cloud recovery, RTO/RPO, high availability, failover systems
Learn risk assessment, threat identification, vulnerability analysis, likelihood/impact assessment, risk matrices
Get certified, DRII (Disaster Recovery Institute International) CBCP certification, ISO 22301 lead implementer
Build experience in risk management, IT operations or security
What to learn
- AI-powered threat monitoring and risk scenario generation
- Cloud-based disaster recovery and backup strategies
- Cyber resilience (combining cybersecurity and BCP)
- AI-orchestrated DR runbook automation
- ISO 22301 and regulatory compliance frameworks
AI tools worth knowing
Finnomena Resilience
Priority: Recommended
AI-orchestrated DR and continuous dependency mapping
Ensono AI DR
Priority: Recommended
AI-assisted disaster recovery orchestration and predictive analytics
Quest DR Planning
Priority: Optional
AI-driven DR plan testing and gap identification
OpenAI Enterprise 4
Priority: Essential
Automated technical drafting, documentation synthesis, and procedural queries for Business Continuity Manager workflows
Where people move next
4 recorded moves- 01Risk Management AnalystSidewaysModerateexposure 426-12 monthspay +5%75%
- 02Internal AuditorStep upModerateexposure 792-3 yearspay +40%70%
- 03Cybersecurity GRC ConsultantSidewaysEasyexposure 356 monthspay +15%65%
- 04IT AuditorSidewaysModerateexposure 796-12 monthspay +10%60%
The bar is the share of skills that carry over from this role, so a longer bar is a shorter move. Step up means the destination is more senior; sideways means it sits at the same level.
Kenyan market notes
Business continuity is growing in importance in Kenya due to increasing operational risks and regulatory requirements. Key risks include terrorism (al-Shabaab attacks in Nairobi, Mombasa, northeastern Kenya), political violence (election cycles), natural disasters (floods in Nairobi, western Kenya; droughts in arid areas), power instability (KPLC grid failures), cyber threats (ransomware and phishing attacks), pandemics, and supply chain disruptions. Freelance BCP consultants serve banks, NGOs, and oil and gas firms on ISO 22301 implementation projects, charging KES 15,000-30,000 per day for consultancy engagements. Regulatory requirements include CBK (Central Bank of Kenya) requiring banks to have BCPs and operational resilience frameworks, IRA (Insurance Regulatory Authority) requiring insurers to maintain BCPs, and capital markets regulations requiring operational resilience. ISO 22301 is the international standard.