Major Incident Manager

Major Incident Manager (MIM)

Incident command role leading P1/P2 major incidents end-to-end, with strong process knowledge, analytical decision-making and tool ownership.

Support level

Incident Command

Domain

Major Incident Management

Scope

P1/P2 Incident Command, ITSM & Monitoring, PagerDuty, Dashboards & Automation

Lead P1/P2 major incidents end-to-end in a 24x7 global operations environment. Own the incident process, analyze fast and decide under pressure, and run the ITSM, monitoring and alerting tools that support the war room.

Process

Incident Command and Process Knowledge

• Act as the Incident Commander for Major, P1, and P2 incidents, ensuring effective command and control, clear ownership, and seamless stakeholder communication throughout the incident lifecycle.
• Activate and lead war rooms/bridges, bringing in the right L2, SRE, Cloud, Infrastructure, Network, Security, Platform and Application teams.
• Run the incident, problem and change process end to end logging, escalation, RCA/PIR, corrective and preventive actions, and SLA governance.
• Manage the escalation path from Monitoring to Incident Response to Engineering to Platform Owners to Executive Management.
• Maintain a clear incident timeline, decision log, action owners, and recovery status throughout the event.
• Coordinate parallel technical troubleshooting so teams stay aligned to service restoration.
• Drive RCA and post-incident reviews and track corrective and preventive actions through closure.

Quick Analysis and Decision-Making

• Analyze incident symptoms, scope and business impact quickly to guide the response.
• Prioritize troubleshooting steps and sequence workstreams across technical teams.
• Make rapid decisions based on business impact, severity, risk and the evidence available.
• Determine when to escalate, when to hold, and when an issue needs executive visibility.
• Balance speed of restoration against governance, change control and risk.
• Identify recurring incidents and failure patterns and work with SRE/automation teams on prevention and self-healing.
• Possess engineering mindset so that process enhancements and advancements can be led by MIM via automations

Tools, Integration and Reporting

• Log, triage and track incidents in ServiceNow, keeping records accurate for reporting and governance.
• Monitor service health and correlate events using Datadog and Splunk dashboards.
• Administer PagerDuty: escalation policies, on-call schedules, responder engagement and the user interface.
• Trigger, acknowledge and track alerts in PagerDuty, and run war-room activation from an incident notification.
• Build and maintain integrations between ITSM, monitoring and alerting tools.
• Create and maintain dashboards for incidents, SLA and KPI reporting.
• Have experience and technical knowledge to streamline incident workflows, notifications, and reporting tasks.
• Track and report MIM KPIs: detection time, war-room activation time, response time and resolution performance.
• Provide concise, accurate stakeholder and executive updates throughout the incident lifecycle.
• Keep ServiceNow tickets current, with clear resolution and closure notes.
• Work with Hosting, Cloud, Network, IDAM and Security teams on cross-tower incident coordination.

Tools

• ServiceNow
• PagerDuty
• Datadog
• Splunk
• MS Teams and reporting tools

Technologies

• Incident, problem and change management (ITIL)
• Cloud infrastructure: AWS, Azure and GCP
• On-premises infrastructure: compute, network and storage
• Monitoring and observability
• Alerting and on-call management
• Tool integration and dashboard creation
• Workflow automation

Experience

• 12+ years of hands-on major incident management / incident command experience
• Experience running P1/P2 incidents in a 24x7 global operations environment
• War-room leadership and cross-functional technical coordination
• Strong analytical and rapid decision-making skills under pressure
• ServiceNow administration for incident, problem and change
• PagerDuty administration, including escalation policies and on-call setup
• Working knowledge of public cloud (AWS/Azure/GCP) and on-premises infrastructure
• Clear, concise executive communication skills

Certifications

• ITIL 4 Foundation
• PagerDuty tool trained
• Splunk & Datadog Fundamentals