Jarred awake by your ringing phone, bloodshot eyes groggily focus on a clock reading 3:00 AM. A weak "Hello?" barely escapes your lips before a colleague frantically relays the happenings of the evening. As the story unfolds, you start to piece together details leading you to one undeniable fact: Something has gone horribly wrong...Despite the many talks addressing the technical mechanisms of security incident response (from the deep forensic know-how to developing world-class tools) the one aspect of IR that has been consistently overlooked is the human element. Not every incident requires forensic tooling or state of the art intrusion detection systems, yet every incident involves coordinated activity of people with differing personalities, outlooks, and emotional backgrounds.Drawing from years of real-word experience, hundreds of incidents worked by Microsoft Security Response Center’s Cloud and Enterprise Incident Response team, and the many lessons learned from some of the greats in IR around the company this talk will delve into:• Classification of incidents into those requiring high touch and high interaction, • The human characteristics that contribute to successful outcomes amidst crisis, • Common pitfalls that can strain and derail investigations, and • Essential skills and mindset needed to make a career as a security first responder.Come join us as we share observations on the common traits of successful defenders -- with insights aim at career and occasional defenders alike. It is now 3:05AM. Everything has gone horribly wrong. They are waiting on you to tell them what to do. This is your time to sink or swim. Good luck.