Security Incident Triage as EM

As an engineering manager, how do you run the first 60 minutes of a suspected data-exposure incident?

Answers use simple, clear English.