Security Incident Triage as EM
As an engineering manager, how do you run the first 60 minutes of a suspected data-exposure incident?
Answers use simple, clear English.
Quick interview answer
Declare an incident commander, freeze risky deploys, contain (revoke tokens, isolate systems), preserve evidence, assess blast radius with facts not blame, notify security/legal per playbook, and communicate a single status channel. Schedule a blameless postmortem with corrective actions and owners.
Detailed answer
Declare an incident commander, freeze risky deploys, contain (revoke tokens, isolate systems), preserve evidence, assess blast radius with facts not blame, notify security/legal per playbook, and communicate a single status channel. Schedule a blameless postmortem with corrective actions and owners. Speed of containment beats perfect root cause in hour one.
Full explanation
Speed of containment beats perfect root cause in hour one.
Real example & use case
Slack alert of public S3 bucket: IC pages security, blocks public ACL, rotates keys, then investigates how it was opened.
Pros & cons
Pros of clear IC: parallel work without chaos. Cons: over-communicating unconfirmed PII details can worsen legal risk.