Incident Response Engineer

Before we go any further, note the word ‘engineer’ in the title.One of the definitions by the Oxford dictionary of 'engineer' is:‘Skilfully arrange for (something) to occur.’With that in mind, let’s get on with it.

Basic technical abilities

Andrew is an IR engineer who has been called in to respond to a security incident in a large Windows environment. In this case, Andrew needs to be familiar with the operating system and at the very least, all the basic protocols and technical aspects of conducting a response exercise in a Windows based environment. He needs to be able to perform basic triage, gather evidence and then classify artefacts correctly. In order to effectively carry out these steps, he needs to be across all the tools required to assist with the process thus far. At this point, he should have clear knowledge of what the next steps are and what other team(s) he needs to engage in order to progress the response process to the next step.

Advanced abilities

Helen is a commercial airline pilot with many years of experience flying large passenger aircrafts with commercial airlines. She has flown around the world and has exceptional technical knowledge when it comes to piloting aeroplanes. This example helps us understand what makes her a good pilot:On one of the long haul flights under Helen's command, there is an incident on the aircraft. Working in conjunction with the crew, Helen  quickly determines it is a serious incident and declares an emergency. The decision on what needs to happen next is now with Helen. Helen quickly assesses the situation and makes the decision that they need to land the aircraft as soon as possible. She quickly delegates the first set of tasks to her crew. One of the tasks is to find the nearest airport that they can make an emergency landing in. Another very important task is that of communications with the relevant authorities on ground. Once they have that information, Helen quickly asks for all information on that location. Once she has acquired all the information on the environment they are about to face, she gets her team to work on the different aspects of the new location such as type of airport, type of runway, headwind, ground facilities etc. All of this information needs to be clearly inspected, analysed and then laid out in a simple but comprehensive format so that the entire team can use it for further decision-making. 
After going over the information, Helen makes a few more decisions and quickly asks her team to check her decisions and see if there's anything that she has missed. All this time, there is a clear and direct line of communication open with the ground authorities where all updates regarding the situation onboard the aircraft are relayed flawlessly to the air traffic control team.
After all the calculations have been made, Helen approaches the runway and under clear guidance from the team on the ground, the aircraft lands without any incident. More over, because of the clear line of communications between the aircraft and the ground team, emergency services are already on the runway, ready to start helping the crew and the passengers.
Helen's job here is to land the aircraft safely and she has the technical and operational experience to that. But as you can see above, this is not her only job. She needs to make sure they pick the right airport. She needs to make sure that they land in the right airport (in the right country) that has all the facilities required for such an event. She needs to make sure that they have an emergency team deployed on the ground when the aircraft lands (for this she needs to make sure that they know what the situation is on the aircraft so they get the right people deployed on the ground). She needs to make sure everyone on the aircraft remains calm. There are lots of decisions she needs to make in the moment and make sure they're all the right ones. She runs her decisions past others in the team to make sure she hasn't missed anything. She needs to delegate tasks, spreading the workload and also making sure she uses the different skillsets within the team. She needs to be assertive while dealing with other teams such as the air traffic control. Most importantly, she doesn't panic under stress. She didn't just land the aircraft in an unfamiliar location, she engineered a perfect emergency landing.

Don’t panic

Cameron is an experienced and highly capable paramedic with years of experience in high-stress active duty. When on shift, Cameron has to deal with anything from an elderly person suffering a domestic accident to drug overdoses and serious assaults. When faced with a situation where lives are at risk, one thing Cameron and his team can't afford to have in the mix is panic. Lives depend on their ability to handle the situation without any panic, by following the protocol down the letter, while using their own judgement and experience to make sure they take actions best suited to the condition of the people they're trying to help. This saves lives. 
How do you get to this point in your career? Hands-on experience. Lots and lots of it. BUT you need to be a certain type of person who can handle stress in a positive way. That, is hard to teach. It has to come from within. Even experienced people panic and make wrong decisions.
What makes Cameron a good paramedic in this example is his natural ability to handle stress well, combined with his practical field experience.


Make better decisions

Ask Questions and don’t be afraid to ask them

Communicate clearly

- Use bullet points where applicable
- Assign tasks clearly to individuals if possible
- Make sure recipients know how to contact relevant parties and when
- Always include a TL;DR at the start of all communications

Make your team challenge your decisions

Don’t panic



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store