Senior Lead Associate - ITSM Major Incident Management

Key Responsibilities

• Act as incident commander for major incidents during assigned 24/7 shifts, validating severity and business impact, initiating the bridge or war room, mobilizing resolver teams and maintaining clear action ownership until service is restored and stabilized.
• Execute the global Incident and Major Incident Management procedures, controls, communication standards and escalation paths defined by the Senior Senior Lead Associate – ITSM Major Incident Manager / Process Owner.
• Assess and communicate impact to critical insurance services, customers or policyholders, business operations, colleague productivity, data availability, cybersecurity and resilience, based on verified information.
• Coordinate application, infrastructure, cloud, network, digital workplace, cybersecurity, service desk and supplier teams across regions without assuming technical-resolution ownership.
• Maintain an effective incident cadence: confirm priorities, challenge delays, track actions and decisions, manage handovers and escalate resource or decision barriers promptly.
• Issue timely, accurate and audience-appropriate stakeholder communications, including operational updates, executive summaries, restoration notices and handover records.
• Maintain complete ServiceNow major-incident records, including chronology, impact and urgency, affected service/CI, actions, decisions, ownership, communications, restoration and closure evidence.
• Ensure follow-the-sun handovers preserve context, priorities, outstanding actions, risks, communication commitments and decision ownership across shifts.
• Support post-incident reviews by assembling evidence, documenting the timeline, identifying command or control lessons and tracking agreed actions; ensure root-cause investigation is routed to Problem Management and implementation actions to Change Enablement.
• Monitor operational measures such as acknowledgement, communication and restoration performance, SLA/OLA adherence, recurrence, handover quality and record completeness; report exceptions to the process owner.
• Coordinate appropriately during cyber or resilience events with the accountable security, continuity and business teams while maintaining disciplined incident command and information handling.
• Support the Senior Senior Lead Associate – ITSM Major Incident Manager / Process Owner with simulations, playbooks, audit evidence, trend reviews, process health checks and the continual-improvement backlog.
• Coach service desk, resolver and junior process colleagues on severity assessment, escalation, communication, swarming and major-incident record standards.

Skills, Knowledge & Expertise

• Total professional experience: approximately 10 years, including significant relevant experience in enterprise Incident and Major Incident Management.
• Demonstrated experience commanding severe, business-impacting incidents in complex application, infrastructure, cloud, network or supplier environments.
• Experience coordinating multiple resolver groups, global stakeholders and third parties under pressure while maintaining clear communications and records.
• Practical ServiceNow Incident Management experience, including major-incident workflows, priority, service/CI context, assignment, communications, dashboards and audit history.
• Experience working in 24/7, follow-the-sun, command-centre, NOC, service operations or equivalent high-availability environments.
• Education: bachelor's degree or equivalent professional experience in technology, engineering, business operations or a related discipline.

• Experience in a GCC, shared-services or multinational organization and in insurance, financial services or another highly regulated industry.
• Exposure to crisis exercises, operational resilience, observability, AIOps, ChatOps or service dependency mapping.

• ITSM/process expertise: strong knowledge of ITIL 4 Incident Management, major-incident procedures, prioritization, escalation, swarming, Monitoring and Event Management, Service Level Management, Problem Management, Knowledge Management and Continual Improvement.
• Incident command: establishes control quickly, distinguishes facts from assumptions, sets a clear cadence and maintains restoration focus in high-pressure, ambiguous situations.
• Technical/platform capability: strong functional use of ServiceNow Incident Management and major-incident workflows, service/CI context, assignment and escalation, notifications, dashboards, reporting and audit history.
• Business-impact judgement translates verified technical information into clear operational, customer, policyholder, security and resilience implications.
• Stakeholder communication: produces concise, accurate updates for resolver teams, business leaders, service owners, suppliers and executives.
• Differentiators: global command-centre experience, automated communications, observability integration, cyber-incident coordination or simulation facilitation.

• Approximately 10 years of total professional experience with substantial enterprise Incident and Major Incident Management experience.
• Proven command of high-impact incidents across multiple technical towers and suppliers.
• Strong ServiceNow Incident Management functional experience and disciplined chronology, communication and closure records.
• Ability to work closely with the Senior Senior Lead Associate – ITSM Major Incident Manager / Process Owner and execute established global standards while escalating material exceptions.
• Ability to communicate verified business impact, risks, actions and restoration status clearly under pressure.
• Willingness and ability to work 24/7 rotational shifts, including nights, weekends and public holidays as rostered.
• Evidence of contributing to post-incident learning, control improvement, simulations or analyst coaching.

• ITIL 4 Foundation & ITIL 4 Intermediate will be beneficial
• Relevant ServiceNow training or certification is advantageous where it demonstrates functional Incident Management capability.
• Crisis management, business continuity or operational resilience training is a differentiator rather than a mandatory requirement.