Core takeaway: a unified monitoring and major incident team after CDS Post Trade Modernization could not run as seventeen people reporting to one manager for every pager, bridge, and shift handoff. The operating model put routine monitoring and incident work through three team leads and kept escalations, executive communications, and lead development with Manager, IT Operations and Incident Response.

I held that manager role at TMX Group from February 2025 to October 2026. The mandate was L1 Monitoring and Major Incident Management, not infrastructure ownership. Headcount moved from 17 to 14 when two support groups merged into one operating team.

What the three leads carried

Day-to-day monitoring and major incident work ran through the team leads.

That included the steady operating rhythm of the unified team: coverage expectations, incident handling habits on the floor, and the first-line coordination that should not wait for a manager slot on every bridge. The leads were the daily owners of that rhythm after amalgamation.

Why that split mattered: capital markets and post-trade services punish fuzzy ownership. If every escalation waits for one manager, you get slower routing and weaker habits in the people who actually answer pages. The leads needed room to run operations while the manager protected escalation quality and executive-facing clarity.

What stayed with the manager

My accountability covered:

  • escalations
  • executive communications
  • development of team leads for broader incident responsibilities

Those three items share a pattern. Each one crosses team boundaries, executive visibility, or career growth in ways a single shift lead should not own alone.

Escalations need a consistent path upward when technical owners disagree or severity jumps. Executive communications need one accountable voice so updates stay aligned with what the bridges actually know. Lead development needs deliberate coaching tied to incident ownership over time, not only ticket throughput.

I also owned the operating model itself: whether escalation paths stayed usable, whether executive updates matched bridge reality, and whether the team leads could take broader incident ownership as they matured. That is manager work even when the leads run the floor well.

Live P1 and P2 work stayed explicit

I served as Incident Lead for P1 and P2 incidents across TMX, excluding Trayport.

Live lead assignment stayed narrower than process design. I designed, documented, and implemented incident management across TMX businesses and subsidiaries, including Trayport, for all severity levels. Holding live P1/P2 lead on the TMX surface while excluding Trayport live lead is a stated boundary, not a contradiction.

Hiring read: do not collapse process ownership and live incident lead into one slogan. Both facts are on the record. Misreading that boundary is how teams fight about who owns the bridge while services are degraded.

Amalgamation forced the model, not a hero story

Two support teams consolidated following CDS Post Trade Modernization so monitoring and major incident management sat in one operating team.

Merging cultures is harder than moving boxes on an org chart. Without shared severity language, shared escalation habits, and clear team-lead lanes, amalgamation becomes two paging cultures in one meeting. The three-lead shape gave the unified team visible day-to-day owners while the manager held the cross-cutting accountabilities amalgamation usually breaks.

That headcount change is organizational consolidation. It is not a savings claim or a performance metric. The hard part was one operating picture, not the number on a slide.

Tools supported the mandate without redefining it

Monitoring and observability used Splunk Observability Cloud, Dynatrace, and Grafana. Workload and operational automation used Control-M and Ansible Automation Platform.

Those tools helped detection and handling. They did not convert the role into platform engineering or infrastructure ownership.

ServiceNow Major Incident Management integration, including Google Workspace automation that creates a Chat space and Meet bridge per troubleshooting team, removed avoidable setup friction at incident start. The team leads and the manager still had to run the model those tools sat inside.

How to use this in hiring

Use this record if you need someone who has run monitoring and major incident work through team leads after consolidation, kept escalation and executive paths clear, and developed leads toward broader incident ownership without inventing ops metrics.

Do not use it as proof of infrastructure build ownership or Trayport live P1/P2 incident lead. Employment at TMX ended in October 2026.