Incident roles define who is responsible for what so everyone knows where to focus during an incident. Roles bring order to the incident response process and ensure your team is set up to communicate timely and effectively.
Common roles
Every team has different needs and operates accordingly. However, these are some of the most common roles in incident management:
Incident commander
Every incident needs an incident commander or incident lead. This person is responsible for overseeing the entire incident response process. For more minor incidents, the incident commander might even handle stakeholder communication.
Communications lead
For larger teams or more complex incidents, a dedicated communications lead can help ensure timely and consistent messaging to stakeholders. They might handle external and internal communication across various channels. This role is often led by someone from the customer support or success team. The communications lead must be a skilled writer and be able to think and act quickly. Most importantly, they need to have a strong understanding of customers and stakeholders.
Technical lead
The technical lead is responsible for investigating the technical aspects of the incident, identifying the root cause, and developing solutions to resolve the issue. They often communicate updates to the incident management or communications lead.
Responder
Depending on the magnitude of the incident, the technical lead might have incident responders working with them. A responder is typically someone from the development or operations team who can execute specific technical tasks to mitigate the incident, such as deploying fixes, running diagnostics, or implementing workarounds.
Customer support lead
For major incidents that are likely to trigger an influx of support inquiries, a support lead is often added to the incident response team to ensure appropriate communication with impacted users. In large-scale incidents, the support team may need to scale up staffing to manage the volume of inquiries.