The pager just went off and production is degraded. Walk me through your first fifteen minutes.

Acknowledge the page, confirm the user impact, and declare an incident with a clear owner and a communication channel. Then stop the bleeding before you diagnose: check what changed recently and roll back or disable the suspect if the timeline fits. Keep a running timeline of actions in the channel, communicate to stakeholders on a fixed cadence, and only start root cause analysis once impact is contained.

First I acknowledge the page so nobody else duplicates the work, then I check whether users are actually affected, because an alert firing and customers hurting are not always the same thing. If it is real, I declare an incident, take incident commander or hand it to someone else explicitly, and open a channel so there is one place for the timeline. Then mitigation before diagnosis. The single highest yield question is what changed, so I look at recent deploys, feature flags and infrastructure changes in the last few hours, and if anything lines up with the start of the impact, I roll it back or flip the flag off. I do not need to understand the bug to stop it hurting people. While that happens I post an update on a fixed cadence, roughly every fifteen or twenty minutes, even when the update is that we are still investigating, because silence makes people come and ask individually. I keep noting actions with timestamps as I go, partly for the postmortem and partly so anyone joining can catch up without interrupting.