Matt Linton is a security generalist and DFIR specialist with 18 years of experience breaking, fixing, and laughing at computers. He is formally trained in Disaster Management and has 20 years of experience as an emergency responder with various fire departments and USAR teams. Currently with Google and formerly with NASA, he has attacked and defended environments large and small, near and very, very far away. He is still uncomfortable referring to himself in the third person. The security industry focuses a great deal on defense, detection and investigation of advanced threats, but the red team always wins in the end. Once an attacker is on your network, it’s imperative to quickly get them back out! This talk explores how Google performs incident management and remediation at scale, adapting the techniques of disaster management professionals and modern open source tools to achieve lightning-fast, efficient response cycles and push the envelope in the field of Incident Response.