Incident manager

Also see related Incident manager role profile.

Career story

Incident manager: Practitioner

Rob, Department of Customer Services, Open Data and Small and Family Business

Tell me about your career journey up to your current role. How did you get started in your role?

I came to cyber security by an unconventional pathway. I spent 18 years in the Australian Army as an officer in a combat role. I spent most of my career in the field or deployed overseas far away from a computer screen.

In my spare time I decided to undertake some study for professional development. I decided to study cyber security because I knew the importance of securing information. I quickly became enthralled in the field of cyber security and the asymmetric power it gave criminals and nation state actors. I was also shocked by the scale of the impact of cybercrime on our population.

Through a veteran networking group, I learned of the Queensland Government Cyber Security Unit and their role in providing cyber security services to the whole-of-Queensland-government. I was fortunate in that they were looking for a non-technical person to fulfill an incident management role, so I applied through Smart Jobs.

What attracted you to your current role?

I am motivated by a desire to protect good people and to stop bad guys. I think we all know a family member that has been scammed by a cybercriminal, our data leaked in a high-profile hack or been unable to access online services due to a disruption to services.

What I love about incident management is that we regularly deal with real life incidents that impact real people. When you see a data leak occur or you are helping to respond to a disruption to service it is fulfilling to know that the actions we take are helping to minimize the harm to Queenslanders and helping to maintain the online services that they rely on every day.

What were the key skills and job experiences from your previous career or role that helped you transition to your current role?

Being able to stay calm and communicate clearly in a stressful situation is paramount. Experiencing a cyber incident may be one of the most stressful experiences an organisation or individual can go through in their professional career. At these times it is important to remain calm, follow the processes, break the big problem into manageable and solvable problems, and communicate decisions clearly.

Were there any specific learning and development courses or certifications that were helpful for you to make the switch or enter this role?

I did a post graduate degree in Cyber Security Operations before I started this role. While I do not think that this is essential, it was helpful because I did not have an IT or technical background. The study gave me a very good understanding of the fundamentals of cyber security, the relevant legislation, frameworks, and principles.

What key behavioural skills are most important for this role profile?

I think that the most important skill to have in this role are the ability to problem solve. A cyber security incident can look like such a huge problem, but it is important to be able to break it down to the multitude of smaller problems that need to be solved. What is the impact to services, what are the regulatory implications, what are the legislated notification requirements, is there a risk to other entities? Being able to step through and solve these problems in a methodical manner is key.

Collaboration is also very important. In incident management we engage stakeholders from across the public and private sector to respond to incidents. Being a team player is critical.

Finally, I think communication is vital in this role. We are required to regularly engage with technical and non-technical experts from a range of fields at every level from analyst on a keyboard to executives' leaders deciding what services to prioritise. Being able to clearly and accurately communicate enables effective incident management.

What key professional skills are most important?

The key professional skills I use daily are Incident management, Stakeholder relationship management and Information security.

Can you walk me through a typical day or week in your current role?

I usually begin my morning by reviewing cyber intelligence products, cyber security alerts and other open sources to get an understanding of the current threat landscape. I also use this as an opportunity to determine if any reported incidents might have links to the Queensland public sector.

But from there, every day is different; you never know what is going to happen when you start work for the day.

I might be required to assist a state government entity to manage or respond to an ongoing security incident. I regularly draft communications artefacts to brief executive level leadership to make them aware of ongoing incidents or relevant updates or assist in the preparation of public statements and releases to ensure that Queenslanders are informed of ongoing incidents and receive the best advice on what to do in response to a cyber-attack.

I regularly attend inter-jurisdictional coordination meetings with stakeholders from Commonwealth and other State governments in relation to significant cyber incidents. At these coordination meetings I represent Queensland interests and assist in coordinating the response to protect Queenslanders and the services they rely on.

Even when we are not dealing with an ongoing incident the preparation phase never stops. I assist government departments with reviewing and uplifting their incident management policy or procedures. I also get the opportunity to regularly assist in the planning or delivering of a cyber security exercise to make sure we are all prepared for an incident may occur.

What advice would you give to someone wanting to get started in or transition to a role that you are in?

I think it is worthwhile, and I always feel like we are working on the “pointy end” of cyber security. I would advise that people learn incident management frameworks and processes, stay up to date with contemporary threats and campaigns, ensure that they can communicate clearly in stressful situations and be willing to work hard to stop the bad guys