Multi-Region Claims Platform Recovery Leader

The mandate

A database-region impairment triggered an automated traffic shift that kept dashboards green but replayed stale workflow events into two active claims regions. Customers received contradictory decisions, adjusters acted on diverged case histories, and compensating transactions obscured the original sequence. The platform reliability director resigned after an internal review found that recovery objectives measured service response rather than authoritative claim state.

The interim must start in Frankfurt within three weeks and serve for twelve months, with a possible three-month extension only if the regulator moves the final witnessed exercise. The permanent search begins after the canonical-state design is operating in one market, expected in month six, and the successor will overlap for at least thirty working days before assuming incident authority.

Handover requires all material claims commands to carry an enforceable idempotency and ordering contract; disputed cases from the event must be reconstructed and signed off; regional isolation and re-entry must pass two production-scale exercises; customer operations must reconcile state without engineering intervention; and the permanent leader must command a failover review using the new evidence. Availability percentages alone cannot close the assignment.

The interim may stop releases, quarantine a region, set reliability priorities, change runbooks, redirect the existing workforce and approve recovery expenditure up to EUR 18 million inside the authorised portfolio. Changes to claim policy, permanent hiring, supplier termination, customer redress above delegated limits and architectural commitments above EUR 5 million need executive or committee consent. The seat cannot adjudicate individual claims.

Core underwriting logic, pricing models, non-claims applications and broad customer-experience redesign are explicitly outside scope. The remit is the distributed claims state, failover behaviour, operational reconciliation, incident evidence and reliability organisation needed to make regional recovery truthful as well as technically available.

Why this seat is open

The incident revealed that infrastructure recovery and business-state recovery had been governed as the same result, and the director’s resignation left no single owner for correcting that error. Supervisors expect a witnessed answer before the next renewal cycle, while customer remediation is still consuming operational capacity. A temporary executive must make irreversible reliability choices and then transfer a system whose failure semantics are understood.

What you will own

• Reconstruct the incident timeline across client commands, queues, replicas, workflow engines, caches, compensations, adjuster actions and customer communications.
• Define the authoritative claim-state model, including ordering, idempotency, conflict, retry, late-event, human-override and regional re-entry rules.
• Decide which services remain active-active, become single-writer, degrade read-only or stop during uncertain ownership of state.
• Install business-state service levels that measure correct decisions, recoverable sequence and operational reconciliation alongside latency and uptime.
• Command staged isolation, failover and rejoin exercises using production-scale histories, injected delay, duplicate events and unavailable dependencies.
• Rebuild incident governance so operations, claims, engineering and risk share one decision log and one threshold for customer notification.
• Transfer recovered-case evidence, architecture decisions, exercise results, residual risks and supplier actions through a successor-led simulation.

Candidate qualifications

• Held executive accountability for a distributed transaction or case platform where replicated state carried material customer or regulatory consequences.
• Recovered from duplicate, reordered, stale or conflicting events across regions and can evidence how authoritative state was re-established.
• Designed failure semantics spanning databases, messaging, workflow, caches and human operations rather than treating recovery as traffic management.
• Led regulated incident communications using technically defensible timelines, impact populations and residual-risk statements.
• Directed production-scale resilience exercises that tested re-entry and reconciliation, not simply regional traffic evacuation.
• Handed incident authority and an unfinished reliability programme to a permanent leader through observed command rather than document transfer.

Non-negotiables

• Can take the Frankfurt seat within three weeks and join a continuous executive incident rota during the stabilisation phase.
• Will work across German, British and Irish sites and accept exclusive responsibility for the duration of the appointment.
• Brings live recovery evidence involving distributed business state; generic cloud migration or disaster-recovery governance is insufficient.
• Must disclose current insurer, claims-platform, cloud, database and systems-integrator relationships before access to incident evidence.

1. 49 words maximum. State your earliest Frankfurt start and the longest production recovery you have personally commanded.
2. 49 words maximum. Describe a failover that restored service while corrupting or duplicating business state, and your first containment decision.
3. 49 words maximum. Which single test proves that a recovered claims region is safe to accept writes again?