Incident Manager

Koniag Government Services•Washington, DC

7d•Hybrid

About The Position

Koniag IT Systems, LLC a Koniag Government Services company, is seeking an Incident Manager to support KITS and our government customer Washington, DC. The position is hybrid, requires 3 days onsite. This position requires the candidate to be able to obtain a Public Trust. We offer competitive compensation and an extraordinary benefits package including health, dental and vision insurance, 401K with company matching, flexible spending accounts, paid holidays, three weeks paid time off, and more. Koniag IT Systems, a Koniag Government Services company, is seeking an experienced Incident Manager to support a comprehensive enterprise IT operations and support engagement for a federal customer. This role serves as the primary owner of the enterprise incident management lifecycle, ensuring rapid detection, triage, escalation, resolution, and post-incident review of IT incidents across a geographically distributed, 24x7 hybrid on-premises and cloud environment spanning AWS commercial and GovCloud, Microsoft 365, Azure Government, and enterprise network and application platforms. The Incident Manager operates within a mature ITIL 4-aligned IT Service Management (ITSM) practice and works in close coordination with the enterprise NOC, multi-tier Service Desk, network engineering, infrastructure, and platform operations teams to ensure that all incidents are managed to resolution within established service level objectives. This individual plays a central role in driving service restoration, minimizing business impact, and contributing to the program's continual service improvement objectives through trend analysis, problem identification, and post-incident learning activities. The ideal candidate is a detail-oriented and operationally experienced ITSM professional with a strong background in enterprise incident management, ITIL-based service management practices, and federal IT operations environments. This individual must thrive in a fast-paced, high-accountability 24x7 operational setting and possess the ability to coordinate effectively across diverse technical teams and Government stakeholders under time-critical conditions. This position requires the ability to obtain and maintain an SBA background investigation, HSPD-12 PIV credentials, and applicable IT access authorizations prior to performing work. This position may be primarily performed at SBA Headquarters and/or approved remote/telework locations.

Requirements

Bachelor's degree in Information Technology, Computer Science, Information Systems, Business Administration, or a related field from an accredited college or university. Equivalent work experience may be considered in lieu of a degree.
Minimum of 5 years of experience in IT service management, with at least 3 years of dedicated experience in an Incident Manager, Major Incident Manager, or equivalent ITSM leadership role in an enterprise federal IT environment.
Demonstrated experience managing the full incident lifecycle—including P1 major incident coordination—in a 24x7 enterprise IT operations environment of comparable scale and complexity.
Demonstrated experience with ITIL-based ITSM practices, including incident management, problem management, change management, and knowledge management.
Hands-on experience administering and managing incidents within an enterprise ITSM platform, preferably ServiceNow.
Ability to obtain and maintain an SBA background investigation, HSPD-12 PIV credentials, and all required IT access authorizations prior to performing work requiring such access.
Exceptional communication skills in English—both written and oral—with the demonstrated ability to communicate clearly and concisely under time-critical conditions to diverse audiences including technical teams, program leadership, and senior Government stakeholders.
Proven ability to lead and coordinate cross-functional technical teams during high-pressure major incident events, driving rapid diagnosis and service restoration without direct authority over all participants.
Deep knowledge of ITIL 4 incident management principles and practices, including incident classification, prioritization, escalation, SLA management, major incident management, and post-incident review processes.
Hands-on proficiency with enterprise ITSM platforms, particularly ServiceNow, including incident workflow configuration, queue management, SLA monitoring, escalation rule management, and reporting.
Strong analytical skills with the ability to identify incident trends, recurring patterns, and systemic issues from ITSM data and translate findings into actionable improvement recommendations.
Experience developing and maintaining incident management performance dashboards and metrics reports, including MTTA, MTTR, SLA compliance rates, first-contact resolution rates, and incident volume trends.
Demonstrated ability to develop and maintain a high-quality knowledge base, ensuring Tier 1 and Tier 2 Service Desk personnel have access to current, accurate resolution guidance.
Strong understanding of enterprise IT infrastructure components relevant to incident management, including network, server, cloud (AWS/Azure), Microsoft 365, and enterprise application platforms.
Familiarity with federal IT security and compliance requirements, including FISMA, NIST SP 800-53, Zero Trust Architecture principles, and CUI safeguarding requirements.
Strong organizational skills with the ability to simultaneously manage multiple open incidents at varying priority levels, maintaining accurate records and ensuring no incident falls through the cracks.
Proficiency with Microsoft Office Suite, Microsoft Teams, and enterprise collaboration tools.

Nice To Haves

Prior experience supporting federal civilian agency IT operations programs.
Experience supporting incident management within hybrid on-premises and cloud environments, including AWS and Microsoft Azure/365.
Experience working within an Agile IT operations delivery model, integrating ITSM processes with Sprint-based planning and prioritization.
ITIL 4 Foundation certification or higher (e.g., ITIL 4 Specialist: High Velocity IT, ITIL 4 Managing Professional).
ServiceNow Certified System Administrator (CSA) or ServiceNow Certified Implementation Specialist (CIS) – IT Service Management.
Experience managing incidents within AWS commercial and/or GovCloud environments, including familiarity with AWS monitoring, alerting, and event management tooling.
Experience managing Microsoft 365 and Azure Government-related incidents, including Exchange Online, Microsoft Teams, SharePoint Online, and Microsoft Entra identity incidents.
Familiarity with enterprise network incident management, including LAN/WAN, SD-WAN, routing, switching, wireless, and network security fabric incidents.
Experience with enterprise monitoring and event management platforms (e.g., SolarWinds, Splunk, Dynatrace, or equivalent) as they relate to automated incident detection and correlation.
Knowledge of problem management and root cause analysis methodologies, including Fishbone/Ishikawa analysis, 5 Whys, and Kepner-Tregoe problem analysis.
Familiarity with Agile delivery methodologies and experience participating in Sprint ceremonies within an IT operations context.
Experience supporting post-incident review (PIR) facilitation and corrective action tracking programs in a federal IT environment.
CompTIA Security+, CISSP, or equivalent cybersecurity certification demonstrating knowledge appropriate to managing incidents involving Federal IT systems and sensitive data.
Experience with HSPD-12/PIV credentialing processes and federal identity and access management platforms, including Okta and Microsoft Entra.
Familiarity with Section 508 compliance requirements as they apply to ITSM reporting tools and knowledge management platforms.
Experience contributing to continual service improvement programs within an ITIL-aligned, Agile IT operations environment.

Responsibilities

Own and manage the full enterprise incident management lifecycle from initial detection and logging through triage, categorization, prioritization, assignment, escalation, resolution, and formal closure in the Government's ITSM platform.
Ensure all incidents are accurately classified by priority (P1–P4) in accordance with established impact and urgency criteria, and that appropriate response and resolution timelines are applied and monitored in real time.
Monitor the active incident queue continuously, identifying aging incidents, escalation triggers, SLA breach risks, and stalled assignments, and taking proactive action to ensure forward progress on all open incidents.
Coordinate and drive the timely assignment of incidents to the appropriate Tier 1, Tier 2, Tier 3, or Tier 4 technical resources based on incident category, complexity, and required expertise.
Ensure incidents are escalated promptly and appropriately—both functionally across technical teams and hierarchically to program leadership and Government stakeholders—when SLA thresholds, scope, or business impact warrant escalation.
Maintain accurate, complete, and timely incident records in the ITSM platform throughout the incident lifecycle, ensuring all actions, decisions, workarounds, and resolutions are thoroughly documented.
Serve as the primary coordinator and decision-maker for all Priority 1 (P1) and Priority 2 (P2) major incidents, activating and leading technical bridge calls, war rooms, and cross-functional response teams to drive rapid service restoration.
Ensure P1 critical incidents are acknowledged within 15 minutes and that service restoration is achieved within 4 hours in accordance with program service level objectives, meeting the Government's target of at least 90% of P1 incidents restored within the 4-hour SLA.
Maintain clear, accurate, and timely stakeholder communications throughout major incident events, including initial notifications, status updates at defined intervals, and formal incident closure notifications to the COR and Government stakeholders.
Coordinate with the NOC, Service Desk Manager, technical leads, and program leadership to ensure all required resources are engaged, barriers to resolution are removed, and escalation paths are followed during major incidents.
Lead or facilitate formal post-incident reviews (PIRs) for all P1 and significant P2 incidents, ensuring root cause analysis findings, contributing factors, corrective actions, and lessons learned are thoroughly documented and tracked to completion.
Collaborate with the Problem Manager or Service Management Lead to ensure incidents exhibiting patterns of recurrence or systemic root causes are formally transitioned into the problem management process.
Contribute incident trend data, recurring issue patterns, and workaround documentation to support problem record creation, root cause investigation, and known error documentation.
Track and monitor the implementation of permanent fixes and corrective actions arising from problem management activities, ensuring incident recurrence rates are measurably reduced over time.
Coordinate with the change management process to identify incidents resulting from unauthorized changes or failed changes, ensuring accurate linkage between incident records and associated change records in the ITSM platform.
Participate in Change Advisory Board (CAB) activities as needed, providing incident trend data and operational risk inputs to support change impact assessment and scheduling decisions.
Administer and maintain incident management workflows, categorization schemas, assignment group structures, escalation rules, and SLA configurations within the Government's ITSM platform (ServiceNow or equivalent) to ensure accurate and efficient incident processing.
Develop, maintain, and deliver recurring incident management performance reports and dashboards, including metrics on incident volumes, SLA compliance rates, mean time to acknowledge (MTTA), mean time to resolve (MTTR), first-contact resolution rates, escalation rates, and incident trends by category and priority.
Contribute incident management metrics and performance data to Sprint Review Reports, Monthly Status and Performance Reports, and the service-level/ITSM metrics dashboard submitted to the Government by the 5th business day of each month.
Analyze incident data to identify trends, high-volume categories, recurring issues, and improvement opportunities, providing actionable recommendations to program leadership and the Service Management Lead.
Oversee the development, review, and maintenance of incident-related knowledge base articles, resolution guides, troubleshooting procedures, and known error workarounds in the Government's ITSM knowledge management system.
Ensure Tier 1 and Tier 2 Service Desk personnel have access to current, accurate, and actionable knowledge base content to support first-contact resolution objectives, targeting at least 70% of eligible tickets resolved at Tier 1.
Promote a knowledge-sharing culture across the NOC and Service Desk, ensuring resolution documentation is captured at ticket closure and that institutional knowledge is preserved throughout personnel transitions.
Participate in Sprint ceremonies as required, including Sprint Planning, backlog refinement, and Sprint Retrospectives, contributing incident management workstream priorities, improvement backlog items, and operational performance data to the Sprint cadence.
Maintain and manage incident management-related backlog items in the Government's Agile/ITSM tooling, ensuring items are accurately prioritized, estimated, and tracked to completion each Sprint.
Identify and propose process improvement opportunities for inclusion in the program backlog, driving measurable enhancements to incident management efficiency, SLA performance, and customer satisfaction.
Ensure all incident management activities comply with applicable Federal security, privacy, and compliance requirements, including FISMA, NIST SP 800-53, SBA IT and cybersecurity policies, and CUI safeguarding requirements.
Ensure suspected or confirmed security incidents are promptly identified, escalated, and reported in accordance with SBA incident response procedures and applicable Federal reporting requirements.
Support the application of least-privilege, separation-of-duties, and Zero Trust principles within incident management workflows and access control practices.