IT Incident Commander

State of Oklahoma • Oklahoma City, OK

3d • $100,000 • Onsite

About The Position

The IT Incident Commander supports the Information Services Division at the Office of Management and Enterprise Services (OMES). This full-time position works 40-hour weeks and reports onsite in Oklahoma City. Salary is up to $100,000, based on education and experience. The role leads enterprise major-incident response, coordinating technical teams, stakeholders, vendors, and post-incident improvement activities to support essential public services.

The commander declares major incidents, assigns severity and response roles, establishes communication channels, and makes or obtains time-critical decisions. The position coordinates status communications and escalations, facilitates blameless reviews, maintains incident records and corrective-action tracking, and owns incident-response processes and readiness activities. The role also coaches IT Incident Command Analysts and backup commanders.

The position works in a comfortable office setting and uses a computer and telephone for a large part of the workday. It involves extended desk work, a rotating on-call schedule with occasional after-hours, weekend, and holiday response, and occasional travel to state data centers or agency sites. The position may be designated essential personnel during declared emergencies or continuity-of-operations events. Sponsorship is not available now or in the future.

Requirements

• Bachelor's degree in Information Technology, Business, Emergency Management, or a related field; equivalent professional experience may substitute year-for-year.
• At least 5 years in IT operations, service management, or infrastructure, including at least 3 years leading major incidents in an enterprise environment.
• Demonstrated ability to command multi-team incidents under pressure and make decisions with incomplete information.
• Strong technical literacy across infrastructure, cloud, networking, and application layers to triage accurately and challenge assumptions; the role is not the hands-on fixer.
• Working knowledge of ITIL incident, problem, and change management.
• Experience with ServiceNow ITSM.
• Excellent written and verbal communication skills, including briefing executives and non-technical audiences.
• Ability to pass fingerprint-based background checks and meet CJIS and IRS 1075 personnel security requirements.

Nice To Haves

• Experience in state, local, or federal government IT, or another regulated industry such as insurance, financial services, or healthcare.
• Familiarity with security incident response and breach notification obligations, including NIST SP 800-61 and state breach notification law.
• Experience with observability platforms such as Zabbix, Grafana, Azure Monitor, or Datadog sufficient to read dashboards and interpret alerts.
• Experience with paging and incident tools such as PagerDuty, ServiceNow Major Incident Management, or Microsoft Teams bridges.
• Certifications such as ITIL 4 Managing Professional, FEMA ICS-100/200, or PMP.
• Experience working within agile delivery, including Kanban or Agile Release Train / PI planning.

Responsibilities

• Declare major incidents, assign severity, and establish the incident bridge and communication channels.
• Triage incoming issues to the correct technical owner and engage the SRE as the escalation point for infrastructure and application remediation.
• Assign incident roles and manage the response cadence.
• Make or obtain time-critical decisions, including emergency change approval, failover, and service-degradation trade-offs.
• Escalate incidents to executive leadership, the CISO, and agency leadership according to severity and defined thresholds.
• Issue timely status updates to IT leadership, agency CIOs, the service desk, and executive stakeholders using standard templates.
• Coordinate with security operations, the privacy office, and legal counsel when incidents involve security, data exposure, or public-disclosure implications.
• Brief the Governor's office or agency communications staff, through IT leadership, on incidents affecting public services.
• Manage vendor engagement and hold vendors accountable to contractual response times.
• Schedule and facilitate blameless post-incident reviews within defined timeframes.
• Maintain the authoritative incident timeline and record and ensure audit-ready documentation.
• Track corrective and preventive actions with SRE, Observability, and Automation engineers; report status and overdue items.
• Analyze incident trends and report recurring failure patterns to leadership.
• Maintain the major incident process, severity matrix, escalation paths, communication templates, and on-call rosters.
• Maintain and improve the Warm Handoff Workflow between Service Operations, Incident Command, and the SRE.
• Run incident simulations, tabletop exercises, and disaster recovery drills with domain and agency teams.
• Coach and develop IT Incident Command Analysts and backup commanders.

Benefits

• 15 days of vacation leave annually.
• 15 days of sick leave annually.
• 11 paid holidays annually.
• A comprehensive benefit package with a benefit allowance to offset the cost of insurance premiums for employees and eligible dependents.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior