Incident Response Analyst II

Job Description


Incident Response Center (Analyst)

Job Title - IRC Analyst


Summary


The IRC (Incident Response Center) is the first layer of defense responsible for quick detection and incident response using various monitoring and automation tools, conducting thorough investigation of alerts, classification, and triage. The IRC Analyst is responsible for delivering operations within the IRC across all client data center sites globally. IRC analysts are expected to respond to all alarms/alerts set in the data center environment, including Infrastructure Management (DCIM), Server Automation Operations System (SAOS), CCTV, Access Control Systems (ACS), and Building Management Systems (BMS), providing deep understanding and intelligence of the criticality and impact of incidents to resolver groups.


Responsibilities


Incident & Problem Management

Analysts are responsible for the full lifecycle of incident management, from detection through to resolution and root cause analysis (RCA). This includes acting as incident commanders, maintaining SLAs, documenting actions, and providing insights to support continuous improvement efforts across teams and systems.

• Investigate, report, and respond to alerts, incident response (war room, remote bridges).
• Respond to incidents and critical situations in a calm, problem-solving manner, and conduct in-depth investigation of alerts.
• Be the first line of defense using monitoring and automation tools to conduct investigation, classification, and triage, all within prescribed SLAs.
• Provide deep understanding and intelligence of incident criticality and impact to resolver groups.
• Ensure detailed records of alarm handling activities, including actions taken and resolutions in ticketing tools; file incident reports.
• Act as incident commander during major incidents.
• Understand internal/external communication methods and stakeholder responsibilities.
• Support program managers and facilitate project deliverables, improving operational and engineering initiatives.
• Conduct root cause analysis (RCA) to determine recurring problems.
• Use in-depth questioning and analysis to determine the underlying cause of incidents or problems (Who, What, Where, When, Why).
• Perform duties in compliance with SOPs, MOPs, Runbooks, and Playbooks.

Server, DCIM, Network and Traffic Alarms Operations

This function involves real-time monitoring of infrastructure alarms, determining the severity of alerts, escalating appropriately, and maintaining clear communications with resolver teams. It ensures uptime and system integrity across servers, network infrastructure, and environmental systems.

• Continuously monitor alarm dashboards and systems.
• Investigate and respond to alarms related to Network, Data Center Environment, Server Health, Facility Security, and Safety.
• Identify and acknowledge incidents associated with alarms.
• Assess incidents to determine their criticality and operational impact.
• Engage resolver groups and escalate to higher tiers or management following established paths.
• Maintain communication with teams, stakeholders, and incident responders.
• Follow documented procedures to resolve incidents promptly and effectively.
• Ensure accurate records of alarm handling and resolution activities in ticketing tools.
• Comply with SOPs, MOPs, Runbooks, and Playbooks.

Threat Intelligence, Critical Event Management

Analysts monitor global threat feeds and operational alerts to protect Byte Dance personnel and assets. Responsibilities include triaging alerts related to weather, security, travel, and regional instability, then coordinating appropriate response actions, escalating to law enforcement if necessary, and compiling response reports.

• Monitor Everbridge Visual Command Center (VCC), International
  
  SOS emails, and open-source tools for real-time incidents affecting Byte Dance assets and travelers.
• Monitor tools or queries for specific stakeholder requests.
• Report on violence, severe weather, or threats to life, property, and assets.
• Coordinate emergency responses, including with law enforcement if required.
• Verify incident information accuracy through secondary sources.
• Generate heatmaps to highlight affected areas during…