Incident Response Lead

Incident Command runs every Sev-1 and Sev-2 across the network: power, fabric, defence and the ones that turn out to be all three. The lead is commander on the call — not the best engineer on it, and not required to be. We ran 47 Sev-1s last year and lost customer-visible minutes in 11 of them.

Responsibilities

• Command Sev-1 and Sev-2 events end to end: declare, staff, run the bridge, own the decision, close.
• Own rungs one to three of the escalation ladder. Rung four is held by the on-call Principal and is reached roughly twice a year.
• Decide when to cut a region loose. You will have incomplete information, roughly 90 seconds, and full authority; the review afterwards is about the reasoning, not the outcome.
• Write the review within five working days. Reviews are blameless, published internally in full, and read.
• Chair the weekly readiness meeting and hold runbook owners to their dates.
• Run the quarterly game day, including at least one exercise against Platform Defence in which Sentry is live and is not told it is an exercise.

Requirements

• Five years running major incidents in a network, platform or utility environment, at least two as commander rather than responder.
• Command presence on a bridge with 30 people on it, several of whom are more senior than you and none of whom are in charge.
• Deep enough network and facilities literacy to know when an engineer is guessing.
• Written clarity under fatigue. The review is the artefact that outlives the event.
• On-call one week in three, and the domestic arrangements that make that sustainable.

Nice to have

• Background in utilities, aviation or maritime operations. The command traditions there are older than ours and better.
• Experience of an event you could not explain afterwards, and a written account of it.
• Familiarity with autonomous defensive systems as a participant in an incident rather than as an operator of one.

Process

1. Application read by the hiring manager, not by a filter. Five working days.
2. Screening call, 30 minutes, with the recruiter for the team named on the requisition.
3. Technical or desk conversation, 90 minutes, with two people you would work beside.
4. Site visit, half a day, at the facility named on the requisition. You will walk a hall.
5. Offer, with the band, the screening tier and the on-call obligation stated in writing.