Resume

Xavier Bennet

Major Incident Manager

Sydney, Australia · Australian citizen · Eligible for security clearance · Bennet.rk@gmail.com

Profile

1,200+ major incidents since 2012. Incident command at Workday, and the same job before that at Tabcorp, Macquarie, Nokia and Optus.

I take the chair when the service is down, tell executives what is true, and leave a control so the same failure is harder next time.

Experience

Workday
May 2024 — Present
Service Manager, Major Incident & Problem · North Sydney
NASDAQ: WDAY · Fortune 500 SaaS
Incident commander on 15–17 majors a month, including three P0s that took most of a data centre down.
- Restored access for 42 customers in 37 minutes, first update at 8 minutes, then closed the change-control gap that let it in.
- Brought MTTI down 14% in three quarters — baselined it in Jira, then built alerts and automation with the automation team.
- Cut incident comms from 8 minutes to 2 with a company-approved AI workflow in PagerDuty and Slack.
- Own weekday handovers across the US, Sydney and Dublin. Security incident manager when comms stay with senior leadership. About 22 tabletops to find gaps in runbooks, on-call and architecture.
Tabcorp
Feb 2023 — Apr 2024
Major Incident and Problem Manager · Sydney
ASX: TAH · Wagering & gaming
Built the major incident framework from scratch, chaired change, and kept regulatory reporting current.
- Brought retail stores across Victoria back by directing the rollback of a failed firewall change, then added peer review, director sign-off and impact checks.
- Built the severity model and escalation matrix from scratch. Coached 3 incident commanders.
- Reduced ServiceNow problems from 97 to 42 in 11 months. Cut failed production changes 17% as chair of CAB and the Failed Change Board.
- Cleared a backlog of 34 regulatory incident reports, then kept pace at about one every two days, ITGC-ready.
Macquarie Technology
Jun 2021 — Jan 2023
Major Incident and Problem Manager · Sydney
ASX: MAQ · Cloud, data centre, cyber, telco
Major incident and problem management, including the incident, BC and DR stream for ISO 27001.
- Back online in about 90 minutes after a hardware fault hit ~20% of data-centre traffic, roughly 120 customers.
- Made routine restores consistent. About 30% of majors were routine, but times varied by who was on shift, so the runbooks were rewritten so any shift could follow them.
- ISO 27001 in December 2022 with no findings on major incidents or business continuity. Led that stream.
- 12% off a carrier contract by tracing SLA complaints to coverage gaps. Quarterly award for rotating engineers off a critical bridge after 6 hours.
Nokia
Jun 2018 — May 2021
Service Delivery Manager — Incident, Problem & Change · Sydney
NYSE: NOK · Managed services
Dotted-line team of 14. Every P0 was mine. Bushfire bridges with the RFS and the Telco Authority.
- Ran bridges through the 2019–20 Black Summer bushfires with the RFS and Telco Authority, and set the restoration order for critical public sites.
- Built triage so offshore Tier 1 could declare a major without waiting for Sydney. Flew to India and coached 9 incident commanders through a structural change.
- Led 14 people (3 onshore, 11 offshore). Oversaw majors run offshore and took direct command of every P0.
Optus
Dec 2012 — May 2018
Incident Controller / Duty Manager, Shift Lead · Sydney
Singtel Group · National mobile & fixed
Shift lead for 40 engineers. The 40-minute national tower restore, and the 2014 outage that made the news.
- Restored service in 40 minutes with a 40-engineer shift after a config issue took out ~60% of mobile towers nationally.
- Incident commander for the June 2014 outage that took internet, phone and TV offline across parts of NSW, Victoria and Queensland. Most services back in about 5 hours. Signed off public messaging with corporate comms before VP approval.
- Promoted from incident commander to NOC shift lead within two years. Coached 4 incident commanders. Recognised for back-to-back high-severity bridges of 14+ hours.
NCSI
Service Desk and Incident Controller · Sydney
Service desk
Service desk, then incident controller.
- Worked the service desk, then moved into the incident controller seat.

Selected results

Sixty percent of the towers
Optus · A config change took out about 60% of Optus mobile towers. Full service in 40 minutes, with a 40-engineer shift.
Forty-two customers, thirty-seven minutes
Workday · Access restored for 42 Workday customers in 37 minutes. First update at 8 minutes. Then the change-control gap that let it in.
Victoria retail, rolled back
Tabcorp · Stores across Victoria were dark after a firewall change. I directed the rollback, then put peer review and director sign-off on that class of change.
A fifth of the data centre
Macquarie Technology · A hardware fault hit about 20% of data-centre traffic, roughly 120 customers. Back online in about 90 minutes.
Black Summer, in order
Nokia · Bridges through the 2019–20 bushfires with the RFS and the Telco Authority. Offshore Tier 1 could declare a major without waiting for Sydney.

Capabilities

Major incident command
End-to-end ownership of P1/P2 restoration: engineering, vendors, executives, and the clock. I have run 24x7 NOC shifts of ~40 engineers and global SaaS bridges in the same week of a career.
Crisis and disaster response
Bushfires, national network events, Christmas traffic, iPhone launches. Onshore, offshore and field teams, plus agencies — TIO, RFS, emergency services — and ministerial briefings when the impact is public.
AIOps that actually ships
Not a Copilot tab. Agentic workflows on Gemini, Claude, PagerDuty and Slack that cut broadcast time from eight minutes to two, parse MTTD/MTTI/MTTR, and walk a team through the runbook for the thing that is actually down.
Problem and PIR discipline
Root cause, known-error database, trend analysis, and post-incident reviews that executives will sit through. Recurring noise gets named, owned, and reduced — not parked in a ticket pile.
Multi-vendor governance
SLAs, service reviews, action trackers, and the nerve to renegotiate when post-incident data shows the vendor is the weak link. Telecom, data centre, cloud and wagering suppliers included.
C-level and regulatory rooms
Clear, timed communication under pressure — Fortune 500 SaaS, ASX operators, and state wagering regulators. Confidentiality when the incident is a security vulnerability. Evidence when the government asks.