The IC manages the response. The Liaison manages communication. The Scribe manages the record. But who actually fixes the broken system?
Operations Lead (Ops Lead)
In a small incident, the IC might directly manage one or two engineers. But in a large, complex incident involving multiple teams and workstreams, direct management becomes impossible — the IC would spend all their time on task coordination and lose situational awareness.
The Operations Lead is assigned to manage the tactical, technical execution of the response.
The relationship between IC and Ops Lead follows a clear division:
- The IC defines what needs to be achieved: "We need to restore database connectivity to the EU region."
- The Ops Lead determines how to achieve it and manages the engineers doing the work.
The Ops Lead reports status back to the IC at regular intervals or when something significant changes. They escalate to the IC when a decision is needed that exceeds their authority (e.g., "We can restore connectivity by failing over to the DR site, but that will cause 10 minutes of downtime — do you want to proceed?").
Subject Matter Experts (SMEs)
These are the engineers with the specific, deep technical knowledge needed to diagnose and resolve the issue. They are the ones looking at logs, writing queries, restarting services, and deploying fixes.
Examples: A Database Administrator (DBA), a Network Engineer, a Senior Backend Developer, a Security Engineer.
Role in the structure: SMEs take direction from the Ops Lead (or directly from the IC in smaller incidents). Their job is to execute specific technical tasks and report findings back up the chain. They should not be making unilateral decisions about response strategy — that belongs to the IC. They should be providing the IC with the technical information needed to make good decisions.
A common failure mode: SMEs going "dark" — diving deep into investigation without surfacing updates. A good Ops Lead sets explicit check-in intervals: "Give me a status update every 10 minutes, even if it's just 'still investigating.'"
Interviewers sometimes ask: "What's the difference between an Incident Commander and an Operations Lead?" The key distinction is abstraction level. The IC operates at the incident level — what is the current state, what is the goal, what decisions need to be made? The Ops Lead operates at the task level — who is doing what right now, what is blocked, what needs to happen next technically? In small incidents these roles may be combined, but in large incidents separating them is critical to prevent the IC from losing situational awareness.