XavierBennet

Who am I 👋

• 

  40 minNational restore

  01 · Optus

  Sixty percent of the towers

  A config change took out about 60% of Optus mobile towers. Full service in 40 minutes, with a 40-engineer shift.

  How I ran it
• 

  37 minAccess restored

  02 · Workday

  Forty-two customers, thirty-seven minutes

  Access restored for 42 Workday customers in 37 minutes. First update at 8 minutes. Then the change-control gap that let it in.

  How I ran it
• 

  RollbackVictoria retail

  03 · Tabcorp

  Victoria retail, rolled back

  Stores across Victoria were dark after a firewall change. I directed the rollback, then put peer review and director sign-off on that class of change.

  How I ran it
• 

  ~90 minBack online

  04 · Macquarie Technology

  A fifth of the data centre

  A hardware fault hit about 20% of data-centre traffic, roughly 120 customers. Back online in about 90 minutes.

  How I ran it
• 

  RFSRestoration order

  05 · Nokia

  Black Summer, in order

  Bridges through the 2019–20 bushfires with the RFS and the Telco Authority. Offshore Tier 1 could declare a major without waiting for Sydney.

  How I ran it

• Impressive work bringing the network back on in such a short duration.

• Xavier has been instrumental in redefining how we do major incident, problem management and business continuity across Macquarie.

• Excelled at cross-shore team management at Nokia, proactively traveling internationally to deliver hands-on training and elevate team performance across regions.

• 🎯

  Major incident command

  End-to-end ownership of P1/P2 restoration: engineering, vendors, executives, and the clock. I have run 24x7 NOC shifts of ~40 engineers and global SaaS bridges in the same week of a career.

• 🔥

  Crisis and disaster response

  Bushfires, national network events, Christmas traffic, iPhone launches. Onshore, offshore and field teams, plus agencies — TIO, RFS, emergency services — and ministerial briefings when the impact is public.

• ⚡

  AIOps that actually ships

  Not a Copilot tab. Agentic workflows on Gemini, Claude, PagerDuty and Slack that cut broadcast time from eight minutes to two, parse MTTD/MTTI/MTTR, and walk a team through the runbook for the thing that is actually down.

• 📉

  Problem and PIR discipline

  Root cause, known-error database, trend analysis, and post-incident reviews that executives will sit through. Recurring noise gets named, owned, and reduced — not parked in a ticket pile.

• 🤝

  Multi-vendor governance

  SLAs, service reviews, action trackers, and the nerve to renegotiate when post-incident data shows the vendor is the weak link. Telecom, data centre, cloud and wagering suppliers included.

• 🏛️

  C-level and regulatory rooms

  Clear, timed communication under pressure — Fortune 500 SaaS, ASX operators, and state wagering regulators. Confidentiality when the incident is a security vulnerability. Evidence when the government asks.

1. Workday

   May 2024 — Present

   NASDAQ: WDAY. Cloud HCM and financials, used by more than 65% of the Fortune 500. About 21,000 staff.

   Service Manager, Major Incident & Problem · North Sydney

   Incident commander on 15–17 majors a month, including three P0s that took most of a data centre down.

   • Restored access for 42 customers in 37 minutes, first update at 8 minutes, then closed the change-control gap that let it in.
   • Brought MTTI down 14% in three quarters — baselined it in Jira, then built alerts and automation with the automation team.
   • Cut incident comms from 8 minutes to 2 with a company-approved AI workflow in PagerDuty and Slack.
   • Own weekday handovers across the US, Sydney and Dublin. Security incident manager when comms stay with senior leadership. About 22 tabletops to find gaps in runbooks, on-call and architecture.

2. Tabcorp

   Feb 2023 — Apr 2024

   ASX: TAH. Australia’s largest multichannel wagering and entertainment company. Heavily regulated.

   Major Incident and Problem Manager · Sydney

   Built the major incident framework from scratch, chaired change, and kept regulatory reporting current.

   • Brought retail stores across Victoria back by directing the rollback of a failed firewall change, then added peer review, director sign-off and impact checks.
   • Built the severity model and escalation matrix from scratch. Coached 3 incident commanders.
   • Reduced ServiceNow problems from 97 to 42 in 11 months. Cut failed production changes 17% as chair of CAB and the Failed Change Board.
   • Cleared a backlog of 34 regulatory incident reports, then kept pace at about one every two days, ITGC-ready.

3. Macquarie Technology

   Jun 2021 — Jan 2023

   ASX: MAQ. Australian cloud, government cyber and telecom, with data centres in Sydney and Canberra. Not the bank.

   Major Incident and Problem Manager · Sydney

   Major incident and problem management, including the incident, BC and DR stream for ISO 27001.

   • Back online in about 90 minutes after a hardware fault hit ~20% of data-centre traffic, roughly 120 customers.
   • Made routine restores consistent. About 30% of majors were routine, but times varied by who was on shift, so the runbooks were rewritten so any shift could follow them.
   • ISO 27001 in December 2022 with no findings on major incidents or business continuity. Led that stream.
   • 12% off a carrier contract by tracing SLA complaints to coverage gaps. Quarterly award for rotating engineers off a critical bridge after 6 hours.

4. Nokia

   Jun 2018 — May 2021

   NYSE: NOK. Global telecom vendor. Onshore service delivery over offshore teams, running network operations for the operator.

   Service Delivery Manager — Incident, Problem & Change · Sydney

   Dotted-line team of 14. Every P0 was mine. Bushfire bridges with the RFS and the Telco Authority.

   • Ran bridges through the 2019–20 Black Summer bushfires with the RFS and Telco Authority, and set the restoration order for critical public sites.
   • Built triage so offshore Tier 1 could declare a major without waiting for Sydney. Flew to India and coached 9 incident commanders through a structural change.
   • Led 14 people (3 onshore, 11 offshore). Oversaw majors run offshore and took direct command of every P0.

5. Optus

   Dec 2012 — May 2018

   Singtel Group. National Australian telco across mobile, fixed, enterprise and media. 24x7 national NOC and command centre.

   Incident Controller / Duty Manager, Shift Lead · Sydney

   Shift lead for 40 engineers. The 40-minute national tower restore, and the 2014 outage that made the news.

   • Restored service in 40 minutes with a 40-engineer shift after a config issue took out ~60% of mobile towers nationally.
   • Incident commander for the June 2014 outage that took internet, phone and TV offline across parts of NSW, Victoria and Queensland. Most services back in about 5 hours. Signed off public messaging with corporate comms before VP approval.
   • Promoted from incident commander to NOC shift lead within two years. Coached 4 incident commanders. Recognised for back-to-back high-severity bridges of 14+ hours.

6. NCSI

   Where the desk came before the chair.

   Service Desk and Incident Controller · Sydney

   Service desk, then incident controller.

   • Worked the service desk, then moved into the incident controller seat.

• 📣

  P1 comms template

  What happened, who is hit, next action, next clock. The sentence executives can take upstairs.

  Open template
• 🚨

  Crisis / DR brief

  One page for the night the event is nationally significant. Situation, actions, decisions, next update.

  Open template
• 📋

  Post-incident review

  Empty PIR. Impact, timeline, 5 Whys, clocks, comms review, actions with owners.

  Open template

1. 01

   Restore first. Then tell the truth.

   The job on a P1 is service back, then an honest timeline. Executives do not need theatre. They need impact, next action, and when the next update lands.

2. 02

   The same failure twice is a process problem

   Incident command without problem management is just heroics. Trend the majors, train the room, fix the runbook. That is how you cut volume instead of getting better at firefighting.

3. 03

   Tools are not competence

   PagerDuty, Jira, Gemini and Claude are useful when they change MTTD and MTTR. A licence on a slide is not operations. I build the workflow, then I measure it.

4. 04

   People last longer than the bridge

   Fourteen-hour bridges happen. Fatigue rules, engineer swaps after six hours, and a culture that can say the shift is spent — that is how you still have a team tomorrow.

Where do you work from?

Sydney. Not a relocation story.

Work rights and clearance?

Australian citizen. Eligible for security clearance.

Will you actually take a 2am bridge?

Yes. I ran 24x7 NOC shifts of ~40 engineers. Fatigue rules exist so the room still has a team tomorrow. I am not interested in a job that pretends incidents happen at 10am.

What are you looking for?

Major incident, problem, crisis, command-centre leadership. Global or national P1/P2 ownership. If the role is a ticket queue with no authority on the bridge, it is not the job.

Permanent or contract?

Permanent first. Contract if the seat is real — IC / problem / crisis with executive air cover — not a backfill with no mandate.

Can we see real RCAs and PagerDuty?

No. Those belong to the employer. The Playbooks section is the skeleton I use, stripped of customer data. In the room I can walk a PIR from memory without opening a ticket.

Are you only telco?

No. Telco, data centre, wagering, global SaaS. Same job in different clothes: restore the service, tell the truth, make the next one quieter.