Path: incident response lead

When an alert becomes an incident, the work changes. There are more people, more pressure and more decisions that affect the business: whether to take a system offline, who needs to be told, what to say. Someone has to hold the picture together. That is the incident lead.

What the role involves

• Keeping one timeline of what is known, with times and sources.
• Assigning tasks and checking they are done.
• Making or getting containment decisions, and recording who made them.
• Giving regular, short updates to managers and other teams.
• Making sure evidence is kept before systems are changed.

How the field frames it

NIST SP 800-61 Revision 3, published in April 2025, replaced Revision 2 from 2012. It presents incident response as part of overall cybersecurity risk management and is written as a Community Profile of the NIST Cybersecurity Framework 2.0. It is worth reading after a few months on the floor, because it explains why preparation and recovery matter as much as the response itself.

How to grow towards it

1. Volunteer to keep the timeline during the next incident. It is the best seat in the room for learning.
2. Read old incident reports in your team's records. Notice which decisions took longest and why.
3. Take part in tabletop exercises and practise speaking clearly under pressure.
4. Learn your organisation's notification duties: who must be told, by whom, and when. Your legal or privacy team owns this, so ask them.

Notice how good incident leads speak. They say what is known, what is not known yet and when the next update will come. They avoid guessing out loud. They ask for one specific thing from each person. You can practise this today in your escalation calls and handovers, long before anyone asks you to lead.

Rule of thumb:Rule of thumb: during an incident, a decision written down with a time and a name is worth more than a perfect decision nobody recorded.