Incident phases:
Detection: Alert fires, customer reports, or monitoring catches it
Triage: Assess severity and impact. Who's affected? How badly?
Mitigation: Stop the bleeding. Rollback, failover, or workaround
Resolution: Fix the root cause
Post-mortem: Learn from the incident
Severity levels:
- SEV1: Critical. Major customer impact, all hands
- SEV2: High. Major impact, dedicated responders
- SEV3: Medium. Limited impact, normal response
Interview tip: When describing incidents, follow this structure. It shows you have a systematic approach.