SRE already solved incident response: severities, a commander, a working channel, a timeline, a blameless postmortem. Then we kept it inside engineering. Security has its own process, but it's usually less battle-tested; IT runs incidents out of a ticket queue; marketing runs them out of a group text. And the worst incidents are the ones that hit all three at once. That process is the most valuable thing an SRE team owns, and it's also the easiest way to stop being the team that says no and start being the team everyone calls. This talk covers what I learned bringing the SRE incident model to security, IT, and a PR crisis: where it worked without changes, where it fell apart, and how to show up as a partner instead of a process cop. We'll also cover where AI genuinely helps and how it hands teams with no incident experience a polished process they can't actually run. You'll leave with a severity model every department can read, a handoff checklist, and a DR/IR tabletop format the whole company practices together and, for once, actually enjoys.
Jonathon Klobucar is a tech lead at Socket. He got there the long way, building product at Rdio, then a container platform at Apcera back when that idea was still weird. He founded the SRE team at Iterable and helped launch some Apple services you've used. At Gridmatic he built and ran the real-time operations desk that connected a battery fleet to the California and Texas power grids, which is where he started noticing that reliability problems and security problems are mostly the same problem. Sublime made that official: he built their incident response, MDR, and detection programs from nothing.
