ronutz

The Roles · Who defends it

Incident responder

Written from published sources

The person who takes charge once an event is confirmed as an incident. Where the operations analyst watches and triages, the responder investigates, contains, eradicates and recovers, and then writes what happened. The national guidance frames the work as a lifecycle beginning long before the incident, in preparation, and ending after it, in the lessons the organisation keeps.

What the day looks like

  • Establishing scope: which systems, which accounts, which data, and since when.
  • Containing, which trades evidence against spread and is a judgement made with partial information.
  • Eradicating the foothold and recovering service, in an order the business agrees.
  • Preserving evidence to a standard that survives a regulator, an insurer or a court.
  • Writing the post-incident account, which is the phase most often abandoned and the one that changes anything.

What it answers for

  • The scope being right, since an underscoped incident recurs the following week.
  • Evidence integrity throughout the response.
  • The written record: timeline, decisions and reasoning.

What it is measured on

  • Time to contain and time to recover.
  • Recurrence, which is the honest measure of eradication.
  • Post-incident actions completed rather than merely recommended.

Who it receives from

Security operations
The characterised event and the evidence gathered so far.
Infrastructure and application teams
Access, architecture and the changes that explain what is seen.
Threat intelligence
The adversary's known behaviour, which shapes where to look next.

Who it serves

The organisation's leadership
A clear account of what happened and what it means, while it is still happening.
Legal, regulatory and communications
Facts firm enough to disclose.
The teams who will rebuild
A boundary they can trust between clean and compromised.

Who else has a stake

  • Customers and the public, whose data the incident may concern.
  • Regulators and insurers, who read the record afterwards.
  • Every engineer whose system is inside the containment boundary.

What it takes

  • Decision-making on partial information under time pressure, repeatedly.
  • Forensic care, since the containment step decides what evidence remains.
  • Writing that a lawyer, an auditor and an engineer can each use.
  • The composure to lead a room of people who are frightened and senior.

What the job turns on

Preparation is the phase that decides the outcome, and it happens on ordinary days. Whether logs exist, whether the asset inventory is current, whether the escalation list has the right mobile numbers on it — all of that is settled months before an incident and determines how well it goes. The responder's most valuable hours are therefore the quiet ones spent making the next response possible, and those hours compete with everything more visible.

The published sources

Where it leads

Roles that lead here

The work itself

The Practice covers how this work is done — triage, escalation, evidence, handover — across the whole corpus.

Read The Practice