Reservist Model: Distributed Approach to Scaling Incident Response

Scaling incident response is inherently hard. Incidents happen in waves and have sporadic surges. In 2018, we witnessed this first hand with a "December to Remember," where on average each responder had to deal with multiple incidents across different time zones. In an ideal world you have a large Incident Response team on standby, but hiring enough to match the occasional surge is expensive and impractical. How do you manage the demand without adding a massive headcount?

In this talk, I will describe how we have approached this problem at Netflix: a complex environment with a small incident response team and growing needs. I will delve into how we created the Reservist Program, a pool of auxiliary Crisis Managers that supplement our security incident response function. At the end of the talk, the audience will be equipped to build their own program with simple steps.