Systems fail at 2am. Traders don't stop trading because it's 2am. We're not hiring someone to update a ticket when that happens — we're hiring the person who owns the room until it's fixed, and owns the fix until it can't happen the same way twice.
Why This Matters
Deriv's mission is Trading for Anyone, Anywhere, Anytime. That means production has to hold up across time zones, regulatory regimes, and market hours that never fully close. When it doesn't, the gap between someone noticed and it's resolved, understood, and documented is where trust is won or lost.
We're not building incident management as paperwork. We're building it as an AI-assisted discipline: log correlation, pattern detection, and draft summaries generated in seconds so you spend your energy on judgment calls, not on typing timelines by hand.
Why Deriv
We already run incidents this way, not the old way.
- AI-assisted tooling correlates logs and monitoring signals during live incidents instead of engineers grepping dashboards under pressure
- Incident summaries and trend reports are AI-generated first drafts, refined by the people who actually understand the systemic pattern
- Problem-management actions get tracked to closure, not filed and forgotten — recurring outages are a process failure, not bad luck
You'll extend an incident practice that's already treating reliability as an engineering discipline, not a fire brigade.
We share what we learn. Deriv is where we write about what we're building, what breaks, and what we figure out the hard way.
What You'll Do
Run the incident, not just log it
- Lead response to critical and major IT incidents from declaration to resolution
- Make the triage calls that matter — what's the blast radius, who needs to be on the bridge, when does this get escalated
- Keep technical and non-technical stakeholders on the same page while the situation is still moving
Make the aftermath count
- Lead post-incident reviews built around what changes, not who's to blame
- Track every resulting action to actual closure — an open action item six months later is a failure of this role, not a footnote
- Turn incident data into trend reporting that tells leadership something real about reliability posture, not just a count of tickets closed
Use AI as your second pair of hands under pressure
- Correlate logs and monitoring signals with AI-assisted tooling instead of manually cross-referencing dashboards mid-incident
- Generate incident summaries and spot recurring patterns faster than a manual review ever could
- Apply this the same way to problem and change management, so every action stays auditable and repeatable
Build the muscle that outlasts any single incident
- Maintain and sharpen runbooks, escalation paths, and documentation as living infrastructure, not static PDFs
- Mentor junior team members in incident handling, calm communication under pressure, and the process discipline that makes incidents boring instead of chaotic
Who You Are
You've been the person on the bridge before
- 4+ years in incident management, ITSM, or production operations, including time actually coordinating live incidents — not just attending them.
You make good calls with incomplete information
- Blast radius, escalation path, who needs to be in the room right now — you decide, you own the outcome, and you can explain your reasoning to a peer or a VP with the same clarity.
You write and speak clearly when everyone else is stressed
- You can translate the database is falling over into something a non-technical exec can act on, in real time, without losing precision.
You treat ITIL as discipline, not paperwork
- Incident, problem, and change management practices that are auditable and repeatable — because we fixed it isn't good enough without a trail showing how and why.
You reach for AI tooling by default, not as a last resort
- You already use AI-assisted analysis to move faster during investigations and to sharpen your reporting — this isn't a skill you're being asked to pick up, it's how you already work.
You Help Others Get Better At This, Too
- You go beyond your own bridge calls to help junior coordinators build the same instincts — staying calm, communicating clearly, and following through on the boring-but-critical parts of the job.
Bonus Points
- Certified Incident Manager or equivalent certification
- Concrete examples: a major incident you coordinated, what you did, what changed afterward
- A process or runbook improvement you personally drove, not just contributed to
- Experience applying AI or automation to incident detection, triage, or post-incident analysis
The Honest Reality
This is demanding work. You'll be the calm voice on a bridge call while people two levels above you want answers you don't have yet. You'll make triage decisions that turn out wrong sometimes, and own that in the post-incident review instead of explaining it away. You'll chase problem-management actions that other teams would rather forget existed.
But you'll be the reason a recurring outage stops recurring. You'll turn incident chaos into something auditable, learnable, and genuinely better next time. And you'll do it with AI-assisted tooling doing the grunt work of correlation and summarisation, so your judgment goes where it actually matters.
If you want a role where the ticket queue is the job, this isn't it. If you want to be the person incidents get handed to because you make them less chaotic, it might be.
