IT Incident Commander

About the role

• Job Posting Title
• IT Incident Commander
• Agency
• 090 OFFICE OF MANAGEMENT AND ENTERPRISE SERV
• Supervisory Organization
• IS-CS
• Job Posting End Date

Refer to the date listed at the top of this posting, if available. Continuous if date is blank.

Note: Applications will be accepted until 11:59 PM on the day prior to the posting end date above.

• Estimated Appointment End Date (Continuous if Blank)
• Full/Part-Time
• Full time
• Job Type
• Regular

Job Details

• Full-time 40-hour work weeks.
• Supports the Information Services Division.
• Salary is up to $100,000 based on education and experience.
• Position reports onsite in Oklahoma City.
• Sponsorship: At this time, we cannot offer sponsorship now or in the future.

About the role

As an IT Incident Commander with OMES you will enjoy

• Generous leave including 15 days of vacation, 15 days of sick leave and 11 paid holidays annually.
• A comprehensive Benefit Package with a generous benefit allowance to offset the cost of insurance premiums for employees and their eligible dependents.

Job Details

• Full-time 40-hour work weeks

Responsibilities

Incident Command & Triage (approx. 40%)

• Declare major incidents, assign severity, and establish the incident bridge and communication channels.
• Triage incoming issues to the correct technical owner; engage the SRE as the escalation point for infrastructure and application remediation.
• Assign incident roles (technical lead, scribe, communications lead, subject-matter experts) and manage the response cadence.
• Make or obtain time-critical decisions, including emergency change approval, failover, and service degradation trade-offs.
• Escalate to executive leadership, the CISO, and agency leadership according to severity and defined thresholds.

Communications & Stakeholder Management (approx. 25%)

• Issue timely status updates to IT leadership, agency CIOs, the service desk, and executive stakeholders using standard templates.
• Coordinate with the security operations team, privacy office, and legal counsel when an incident has security, data-exposure, or public-disclosure implications.
• Brief the Governor's office or agency communications staff, through IT leadership, on incidents affecting public services.
• Manage vendor engagement and hold vendors accountable to contractual response times.

Post-Incident Review & Problem Management (approx. 20%)

• Schedule and facilitate blameless post-incident reviews within defined timeframes.
• Maintain the authoritative incident timeline and record; ensure audit-ready documentation.
• Track corrective and preventive actions with the SRE, Observability, and Automation engineers; report on status and overdue items.
• Analyze incident trends and report recurring failure patterns to leadership.

Process Ownership & Readiness (approx. 15%)

• Maintain the major incident process, severity matrix, escalation paths, communication templates, and on-call rosters.
• Maintain and improve the Warm Handoff Workflow between Service Operations, Incident Command, and the SRE.
• Run incident simulations, tabletop exercises, and disaster recovery drills with domain and agency teams.
• Coach and develop IT Incident Command Analysts and back-up commanders.

Physical Demands and Work Environment

• This position works in a comfortable office setting with a computer and telephone for a large percentage of the workday.
• This position requires long periods, up to eight hours per day, of sitting and working at a desk. The noise level in the work environment is usually mild.
• Participation in a rotating on-call schedule, including occasional after-hours, weekend, and holiday response for critical incidents.
• Work supports essential public services; may be designated essential personnel during declared emergencies or continuity-of-operations events.
• Occasional travel to state data centers or agency sites.

Minimum Qualifications

• Bachelor's degree in Information Technology, Business, Emergency Management, or related field; equivalent professional experience may substitute year-for-year.
• 5+ years in IT operations, service management, or infrastructure, including 3+ years leading major incidents in an enterprise environment.
• Demonstrated command of multi-team incidents under pressure, including decision-making with incomplete information.
• Strong technical literacy across infrastructure, cloud, networking, and application layers-enough to triage accurately and challenge assumptions, without being the hands-on fixer.
• Working knowledge of ITIL incident, problem, and change management; experience with ServiceNow ITSM.
• Excellent written and verbal communication, including briefing executives and non-technical audiences.
• Ability to pass fingerprint-based background checks and meet CJIS and IRS 1075 personnel security requirements.

Preference will be given to candidates who possess

• Experience in state, local, or federal government IT, or another regulated industry (insurance, financial services, healthcare).
• Familiarity with security incident response and breach notification obligations (NIST SP 800-61, state breach notification law).
• Experience with observability platforms (Zabbix, Grafana, Azure Monitor, Datadog) sufficient to read dashboards and interpret alerts.
• Experience with paging and incident tooling (e.g., PagerDuty, ServiceNow Major Incident Management, Microsoft Teams bridges).
• Certifications such as ITIL 4 Managing Professional, FEMA ICS-100/200, or PMP.
• Experience working within agile delivery (Kanban, Agile Release Train / PI planning).