Incident Manager
Incident Manager: Leads the overall handling of a security incident. The role maintains the situation picture, objectives, priorities, ownership, and decisions, coordinates technical and business stakeholders, and ensures consistent communication. The incident manager does not perform every investigation personally but remains accountable for a controlled end-to-end process.
How it works and where it fits
Incident Manager belongs to a prepared workflow for handling security-relevant events. A technical signal becomes a substantiated incident only through triage, context, and assessment. Roles, decision authority, escalation paths, and stopping conditions should therefore be agreed in advance so actions remain consistent under time pressure.
Practical security relevance
Execution must balance rapid containment with careful evidence preservation. Actions should not unnecessarily destroy important traces or disrupt business operations without control. Timelines, decisions, and changes are documented; after recovery, root causes, identified gaps, and lessons learned feed back into controls, detection logic, and response plans.
Related concepts
- Incident ResponseIncident ResponseA structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.: A structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.
- Communication PlanCommunication PlanA predefined plan for who communicates what, when, and through which channel during security work.: A predefined plan for who communicates what, when, and through which channel during security work.
- Escalation PathEscalation PathA defined route for transferring a security issue to the appropriate authority or expertise level.: A defined route for transferring a security issue to the appropriate authority or expertise level.
- Post-Incident ReviewPost-Incident ReviewA structured review that captures causes, decisions, outcomes, and lessons after an incident.: A structured review that captures causes, decisions, outcomes, and lessons after an incident.