Shift rosters for a security or network operations centre: fair night cover and handovers

It is ten past six in the morning. The night analyst at a managed network operations centre has a half-finished ticket about a flapping link at a client branch. The day engineer walks in, hears 'all quiet', and sits down. Two hours later the link drops again and nobody knows what the night shift had already tried.

Most roster trouble in a security or network operations centre starts at that moment, and not with the night itself. The hours are hard, but unfair rotation and weak handovers are what push good people to resign. This guide sets out a roster you can build this week.

Pull the last few months of tickets and alerts from your tool and group them by hour of day and day of week. You are looking for where the real load sits. Many centres find that the quiet hours are not quiet for one or two large clients, and that a few named accounts drive most night calls. A roster built on that picture is easier to defend than one built on habit.

Then list what must be covered at every hour. Monitoring, first response, escalation to a senior and a named duty manager are different roles. Write each one down with the skill it needs. A fresher can watch a console, but a fresher alone cannot decide to isolate a client link.

1. 1

   Fix the shift pattern

   Choose the shift start times and lengths that match the load curve. Keep them the same for everyone, so people can plan their lives around them.

2. 2

   Set the minimum cover per shift

   Name the roles, the skill level and the number of people each shift needs, including who is the escalation point.

3. 3

   Write the rest rules

   Decide the gap between the end of one shift and the start of the next, the weekly off, and how many night shifts may run back to back. Check the rules with your own legal adviser, since shift and night work rules differ by state.

4. 4

   Rotate nights in blocks

   Give each person a night block followed by recovery days, instead of one night here and one there. Rotate the block across the team on a published cycle.

5. 5

   Publish early and log swaps

   Release the roster well ahead of the month. Record every swap in one shared sheet with both names and the approver.

6. 6

   Review each month

   Count nights, weekends and festival days per person. If someone is running ahead, correct it next cycle and say so openly.

Fair does not mean identical. It means the rules are written, the counts are visible and exceptions have reasons. A parent of a young child, someone with a medical advice letter, or an engineer in an exam month may need a lighter night load. Decide in advance which reasons the company will accept, who approves them, and how long they run.

• Seniors take nights too. A roster where the senior engineers always hold days teaches juniors that nights are a punishment.
• Newer staff do not do their first nights alone. Pair them with an experienced engineer for the first block.
• Festival and weekend duty is counted separately and rotated, so the same people do not give up every holiday.
• Night allowances, time off in lieu and meal or transport support are set in the pay structure, not negotiated shift by shift.

A good handover has two parts. The first is a written note in a fixed format that goes into the ticket tool, not a personal message. The second is a short live call or a few minutes face to face, where the incoming engineer reads the note back. The outgoing engineer does not leave until the incoming one says they are clear.

Shift date, time and names of outgoing and incoming engineers.
Open incidents: ticket number, client, current status, next action and who owns it.
Changes in progress: what was changed, what is untested, how to roll back.
Clients to watch: planned maintenance, known weak links, anyone who asked for a call back.
Escalations raised: who was called, when, and what they said.
Anything that felt odd but was not yet a ticket.
Incoming engineer read-back confirmed: yes or no, with time.

Night work wears people down in ways a spreadsheet will not show. Watch for sick leave that clusters after night blocks, mistakes that rise towards the end of a shift, and quiet requests to move to days. Treat these as roster signals. A short check-in with each night engineer once a month, asked in the same words every time, gives you an early read.

Cover for sudden absence needs a plan too. Keep a named standby for each shift and a rule for who is called first. The attendance, shift and leave process page shows how GullyHR helps firms write these rules down so a manager can apply them without an argument.

A roster that asks for more nights should be matched by pay that reflects it. That includes allowances and, for the senior engineers who hold the pager, a clear grade. The post on pay and grading for infrastructure and security engineers covers how to place those roles. The wider picture for centres of this kind sits in the managed network and NOC services hub.

• Fixing the roster for the average day and ignoring month-end, patch windows and client go-lives.
• Letting swaps happen by word of mouth, so the record never matches reality.
• Calling the person who answers fastest every time, which quietly gives them all the extra duty.
• Treating handover as a courtesy, not a duty with a written format.