I'm a systems administrator at a medium-sized organization, working alongside a senior sysadmin. I'm currently tied up with a major project, so I asked him to handle several SIEM alerts and operational tickets. He agreed, but a week later the tickets were still open. This has happened repeatedly, not just once.
I already raised the issue with my manager. My manager told me to stay focused on the project and said he would speak with my coworker about handling operational work while I'm busy. A month has passed, but there hasn't been much improvement. What should I do now without overstepping my role or letting important security work get ignored?
3 Answers
There may be missing context here. A senior coworker might have other priorities, or some SIEM alerts could be false positives rather than active incidents. Before assuming deliberate inaction, confirm who officially owns the queue, whether these are urgent security events, and what the expected response time is. If anything is genuinely time-sensitive or poses a security risk, escalate that specific risk immediately instead of treating it as a general coworker problem.
Make sure the work is clearly assigned through whatever ticketing or task-tracking process your organization uses, rather than relying on a verbal request. For example, note that the alerts need attention and that you’re occupied with the project. If they remain open, report the status and business or security impact to your manager. Then leave the staffing and performance issue with management.
You’ve already escalated this to the person responsible for managing both of you. Follow your manager’s direction and focus on the project. Keep a written record of the requests, the ticket status, and any impact caused by the delay so you aren’t blamed later. Don’t try to manage your coworker directly unless your manager has explicitly given you that responsibility.
Exactly. If the alerts are assigned to him and the response deadlines are being missed, bring the ticket history and the consequences to management. If they’re merely low-priority items, keep working on the project as instructed.