Incident commander (IC)
Leads the response and makes the calls. The IC coordinates; they don't do the fixing themselves.
Tech lead (TL)
Investigates and fixes the problem with the engineers.
Communications lead (CL)
Updates customers and stakeholders on a set schedule, so engineers can focus.
Scribe
Records the timeline, actions and decisions for the review afterwards.
After every incident
Run a blameless post-mortem: find and fix the cause, not someone to blame.
Severity levels
- SEV1: full outage
- SEV2: a major feature is down
- SEV3: minor issue
- SEV4: cosmetic
Why it matters for your career
On-call and incident response are part of most SRE, DevOps and platform roles. Calm, structured responders get noticed.
