The situation
Security-platform incidents were flowing into a ticketing environment through an existing vendor integration. The connection worked, but its service-level configuration was generic rather than severity-aware. Critical incidents could remain unclaimed, while lower-severity incidents could sit unassigned for extended periods.
The risk was not a lack of alerts. It was the absence of a reliable, visible path from alert to human ownership.
The leadership decision
Rather than replace the existing integration, I chose to preserve it as the system of record and add a separate acknowledgement watchdog around it. This avoided unnecessary platform disruption while allowing the operating model to be rebuilt where it mattered: identifying an incident, measuring time to acknowledgement, escalating with intent, and stopping only when ownership was real.
How the operating design worked
The resulting workflow applies severity-aware acknowledgement windows and a four-tier escalation path across seven delivery teams. Critical incidents escalate on a 30-minute clock, high-severity incidents on a 60-minute clock, and lower-severity incidents are handled in a way that preserves the audit trail without creating alert fatigue.
The workflow is a state machine, not a simple notifier. It records each incident's escalation state, recognizes genuine human pickup, restarts correctly if an incident reopens, and distinguishes a platform auto-close from a person having taken ownership.
The high-frequency monitoring path does not use model calls. Predictable operational control should not depend on unnecessary AI inference or variable run costs.
How it was validated
I did not treat a successful test as sufficient proof of a working control. Each change was compared against the live deployment, exercised through a local test process using representative operational data, deployed, and then confirmed through a live execution. When a logic gap was found, such as the reopen path, it was corrected before it became a production failure.
The result
The workflow is live in production. Critical and high-severity incidents now follow defined acknowledgement windows through an explicit escalation ladder, lower-severity incidents are retained without creating excessive noise, and each incident has one visible lifecycle from alert through ownership or closure.
The broader lesson
Reliable security automation is not about generating more messages. It is about designing a trusted operating path: clear severity, known ownership, bounded escalation, visible accountability, and verification that the system behaves as intended when conditions change.