Learn/Incident Commander
ROLES

Incident Commander (IC)

The person responsible for all high-level coordination and decision-making during an incident.

Incident Commander

The person responsible for all high-level coordination and decision-making during an incident.

The Captain of the Ship

The Incident Commander (IC) is the absolute authority during a major outage. Their job is not to fix the bug, but to manage the response. Think of them as an air traffic controller: they don't fly the planes, but they ensure none of them crash.

Core Responsibilities

  • Establish Command: Announce "I am the IC" immediately upon joining.
  • Assign Roles: Designate a Scribe and Communication Lead if the incident is complex.
  • Decision Making: Make the hard calls on rollback vs. fix-forward.
  • Status Updates: Ensure the organization stays informed.

The Golden Rule of Command

"The IC does not touch the keyboard."
If the IC starts debugging, they lose situational awareness. Their eyes must be on the entire field, not a single log file.

ExThe Silent Incident

"A database lock caused 50% errors. 20 engineers jumped on a Zoom call and started arguing about the root cause."

Impact
Confusion delayed the fix by 45 minutes.
Resolution
An IC joined, muted everyone, assigned one DBE to investigate locks, and cleared the call. Fix shipped in 10 minutes.

Why Incident Commander Matters

Without a clear leader, decisions stall and chaos increases.

Protects the rest of the team from distractions.

Single source of truth for incident state.

Common Pitfalls

Tunnel Vision
IC gets sucked into debugging logs.
Command Vacuum
IC is too passive; team argues instead of acting.
Burnout
IC tries to run a 12-hour incident alone.

How to Use Incident Commander

👑
Delegation is Key: Do not fix code. Delegate tasks to SMEs.
📢
Regular Updates: Force updates every 30 mins even if nothing changed.
🔄
Handover Cleanly: No IC should serve >4-6 hours. Pass the baton.

Frequently Asked Questions

Who should be the Incident Commander?
Anyone trained in the process. It is a role, not a rank. A junior engineer can be IC for a VP.
Can the IC also be the SME?
Only in small incidents (SEV3/4). In major incidents (SEV1/0), these roles MUST be separate to avoid cognitive overload.
When does the IC stand down?
Only when the incident is resolved or they hand over command to another trained IC.

Learn More