Clearer, Not Louder: Simona Ursan on Leading Incidents

1. What's one thing you've had to unlearn about incident response culture?

One thing I've had to unlearn about incident response is the idea that a successful incident is simply one that gets resolved quickly. Speed matters, but it is not the same as success. Before we declare an incident over, we need confidence that the service is truly stable, that the same failure will not immediately happen again and that we understand why it failed in the first place. You can restore a service in 10m, but if it failed because of something that should have never happened, I would not call that a successful incident. Equally, an incident can last for hours because of significant infrastructure impact and still demonstrate excellent incident response: people mobilized exemplarily, coordinated well, communicated clearly, found alternatives and made good decisions under pressure. For me, success is not measured by the clock alone, it is measured by how well we respond, how safely we recover and what we learn so we are stronger afterwards.

‍

2. Tell us about a time you had to prove your credibility under pressure - what did that look like?

One moment that really shaped my view of credibility under pressure was joining an incident that had already been running for a couple of hours. People were exhausted, the situation had become chaotic and increasing leadership pressure meant that many people were talking but very little was moving forward. I didn't try to be the loudest person in the room or prove that I knew more than the others. I started asking the simple questions: What is the impact that we observed? How did we observe it? When did it start? What have we tried? Who did we engage? I went through the standard generic mitigation questions and so on. Slowly we rebuilt a shared picture and a clear mitigation plan. I started providing regular updates, which gave leaders the visibility they needed to detach from the incident and engage in the escalations received. This allowed the other responders the space they needed to focus. Once the room became calmer, solutions started to emerge. That experience reinforced something I still believe in: credibility in an incident doesn't come from volume or having all the answers, it usually comes from bringing clarity when the room has lost it. There's a certain confidence one projects when they can calmly bring order to a difficult situation and people respond to that.

‍

3. When did you first feel like you were actually leading an incident? What changed?

I first felt I was truly leading an incident 15+ years ago, when I was a Platform Engineer. I was driving home from my parents' house, an 8h journey, when a colleague called me during an incident. I had no laptop, no access to the systems and very little context, yet I was able to calmly walk them through the incident by asking a few questions that needed to be answered to bring clarity and structure to the situation. I realised that because I could see beyond the immediate chaos, I could give others confidence that the problem was solvable.

‍

4. How do you get your voice heard if the room is dominated by louder personalities?

Volume and authority are not the same thing. I focus on being concise, specific and intentional when i speak. I don't try to become louder than the loudest person. I try to become clearer. A well timed question will establish you as the person to pay attention to every time. You need to learn to wait, listen, identify what the conversation is missing and then speak to that.

‍

5. How do you find or build community with the other women in this space when it's so male-centric?

I'm still searching for my tribe. For many years I was the only woman in the room. While there are still fewer women in the room than men, it makes it even more important that we notice one another, connect and bring others with us. For me, it's about choosing collaboration over competition. I'm not 100% sure on how to build a community, but I think we have to start by creating these spaces where we wish these spaces already existed. Share experiences, introduce women to one another, amplify each other's voices and make it easier for the next woman to find her people.

‍

6. How do you progress your career as a woman in incident response?

I'm still learning here, but I'd say the best advice I have to give is to not assume good work will always speak for itself. Make your work visible, build relationships and be clear about where you want to go next. Another equally important thing is to remember you don't have to become someone else's version of a leader to be an excellent one. Stay curious, keep putting yourself into situations that stretch you and don't underestimate your own value. Incident Response itself teaches us to make good decisions with incomplete information, careers are sometimes exactly the same. Don't wait until you feel completely ready.