IT Incident Commander

Refer to the date listed at the top of this posting, if available. Continuous if date is blank.

Note: Applications will be accepted until 11:59 PM on the day prior to the posting end date above.

• Generous leave including 15 days of vacation, 15 days of sick leave and 11 paid holidays annually.
• A comprehensive Benefit Package with a generous benefit allowance to offset the cost of insurance premiums for employees and their eligible dependents.

• Full-time 40-hour work weeks
• Supports the Information Services Division
• Salary is up to $100,000 based on education and experience
• Position reports onsite in Oklahoma City
• Sponsorship: At this time, we cannot offer sponsorship now or in the future.

Incident Command & Triage (approx. 40%)

• →Declare major incidents, assign severity, and establish the incident bridge and communication channels.
• →Triage incoming issues to the correct technical owner; engage the SRE as the escalation point for infrastructure and application remediation.
• →Assign incident roles (technical lead, scribe, communications lead, subject-matter experts) and manage the response cadence.
• →Make or obtain time-critical decisions, including emergency change approval, failover, and service degradation trade-offs.
• →Escalate to executive leadership, the CISO, and agency leadership according to severity and defined thresholds.

Communications & Stakeholder Management (approx. 25%)

• →Issue timely status updates to IT leadership, agency CIOs, the service desk, and executive stakeholders using standard templates.
• →Coordinate with the security operations team, privacy office, and legal counsel when an incident has security, data-exposure, or public-disclosure implications.
• →Brief the Governor's office or agency communications staff, through IT leadership, on incidents affecting public services.
• →Manage vendor engagement and hold vendors accountable to contractual response times.

Post-Incident Review & Problem Management (approx. 20%)

• →Schedule and facilitate blameless post-incident reviews within defined timeframes.
• →Maintain the authoritative incident timeline and record; ensure audit-ready documentation.
• →Track corrective and preventive actions with the SRE, Observability, and Automation engineers; report on status and overdue items.
• →Analyze incident trends and report recurring failure patterns to leadership.

Process Ownership & Readiness (approx. 15%)

• →Maintain the major incident process, severity matrix, escalation paths, communication templates, and on-call rosters.
• →Maintain and improve the Warm Handoff Workflow between Service Operations, Incident Command, and the SRE.
• →Run incident simulations, tabletop exercises, and disaster recovery drills with domain and agency teams.
• →Coach and develop IT Incident Command Analysts and back-up commanders.

• This position works in a comfortable office setting with a computer and telephone for a large percentage of the workday.
• This position requires long periods, up to eight hours per day, of sitting and working at a desk. The noise level in the work environment is usually mild.
• Participation in a rotating on-call schedule, including occasional after-hours, weekend, and holiday response for critical incidents.
• Work supports essential public services; may be designated essential personnel during declared emergencies or continuity-of-operations events.
• Occasional travel to state data centers or agency sites.

• Bachelor's degree in Information Technology, Business, Emergency Management, or related field; equivalent professional experience may substitute year-for-year.

• 5+ years in IT operations, service management, or infrastructure, including 3+ years leading major incidents in an enterprise environment.

• Demonstrated command of multi-team incidents under pressure, including decision-making with incomplete information.

• Strong technical literacy across infrastructure, cloud, networking, and application layers—enough to triage accurately and challenge assumptions, without being the hands-on fixer.

• Working knowledge of ITIL incident, problem, and change management; experience with ServiceNow ITSM.

• Excellent written and verbal communication, including briefing executives and non-technical audiences.

• Ability to pass fingerprint-based background checks and meet CJIS and IRS 1075 personnel security requirements.

• Experience in state, local, or federal government IT, or another regulated industry (insurance, financial services, healthcare).

• Familiarity with security incident response and breach notification obligations (NIST SP 800-61, state breach notification law).

• Experience with observability platforms (Zabbix, Grafana, Azure Monitor, Datadog) sufficient to read dashboards and interpret alerts.

• Experience with paging and incident tooling (e.g., PagerDuty, ServiceNow Major Incident Management, Microsoft Teams bridges).

• Certifications such as ITIL 4 Managing Professional, FEMA ICS-100/200, or PMP.

• Experience working within agile delivery (Kanban, Agile Release Train / PI planning).

The State of Oklahoma is an equal opportunity employer and does not discriminate on the basis of genetic information, race, religion, color, sex, age, national origin, or disability.

Current active State of Oklahoma employees must apply for open positions internally through the Workday Jobs Hub.

If you are needing any extra assistance or have any questions relating to a job you have applied for, please click the link below and find the agency for which you applied for additional information:

Agency Contact