On-Call Rotation Design: Sustainable Schedules for Small Teams
Five-person team, two time zones, one on-call rotation that doesn't burn people out. Here is what we landed on and what we changed after six months.
Five-person team, two time zones, one on-call rotation that doesn't burn people out. Here is what we landed on and what we changed after six months — applicable to small SaaS + firmware fleet shops, not Google SRE scale.
Constraints
Team: 5 engineers (2 senior, 2 mid, 1 junior), PM not on-call. Coverage: US Pacific + US Eastern + one contractor CET overlap. Product: B2B SaaS API + BLE device fleet. Pages: ~8–15/month real incidents, 40% noise first quarter.
Goal: sustainable 24/7 coverage without hero culture.
Rotation v1 (failed)
- 1 week primary, same person also default debugger
- No secondary — "just page backup if needed"
- Handoff: Slack message Monday
Six-month outcomes (bad)
- Two departures cited burnout in exit interviews (on-call one factor among several — still signal)
- Mean time to acknowledge fine; time to resolve crept — primary too tired to escalate
- Junior on-call alone during senior vacation → 90 min SEV2 (Postgres stall) from fear of wrong rollback
Rotation v2 (current)
Structure
| Role | Duration | Duty |
|---|---|---|
| Primary | 1 week | First responder, IC for SEV2+ |
| Secondary | 1 week | Backup ack in 10 min if primary no ack; takes over if primary >2 h deep |
| Shadow | optional | Junior paired 2 weeks/quarter — not solo |
Follow-the-sun bias: week boundaries rotate start day by timezone so CET contractor doesn't always get Sunday night US peak.
Hours policy
- Primary not expected to code features on-call week — 50% capacity budget in sprint planning
- No meetings before 10 AM local on-call week unless incident
- After 2 h continuous incident past midnight — mandatory handoff to secondary or staff escalation
Documented in handbook; manager enforces in sprint.
Escalation ladder
- Primary (15 min ack SLA)
- Secondary (10 min if primary silent)
- Staff engineer (SEV1 only or primary requests)
- CTO (data loss, legal, public comms)
Matches incident runbook roles.
Noise reduction (same project as rotation)
PagerDuty alerts cut 55% before rotation fix mattered:
- Synthetic checks on
/health/deepnot/ - Separate low-urgency channel for disk 70% warnings
- Fleet OTA error rate alert requires >0.5% devices not single device
On-call week usable after noise cut — rotation redesign without alert hygiene fails.
Compensation
We don't pay per-page stipend — controversial. We do:
- Comp day within 2 weeks after heavy week (>5 pages or any SEV1)
- Explicit sprint load reduction
- Postmortem follow-ups not assigned to on-call person that week unless they volunteered
Handoff ritual (15 min Monday)
Template:
Last week pages: [count] — themes: [...]
Known risks: deploy Tue, OTA campaign Wed
Runbook gaps discovered: [...]
Carry-over tickets: [...]
Recorded Loom optional — async-friendly for time zones.
Integration with postmortems
Every SEV1/2 → postmortem → action items not auto-assigned to on-call unless they volunteered. Fixes ownership by domain owner — see postmortem that sticks.
On-call person's input required in timeline section — scribe captures.
Metrics after 6 months v2
| Metric | v1 | v2 |
|---|---|---|
| Pages/week/person max | 14 | 9 |
| Ack SLA miss | 12% | 3% |
| Exit interview on-call mention | 2 | 0 |
| Junior solo pages | common | never |
Not paradise — 9 pages/week still hurts — but survivable with comp day + load rule.
What we rejected
- Monthly on-call — too long for small team; context rot
- Outsource to vendor NOC — couldn't debug Postgres vacuum or BLE stack
- Business-hours only — customers global; accepted pain
Hiring ICs vs managers note
Small team: on-call includes staff/principal IC in pool — not just juniors. Hiring balance aside, rotation must include someone who can authorize rollback on database — usually senior IC.
What I'd do next
Add predictive on-call load — deploy + OTA calendar overlays rotation assignment; avoid scheduling contractor primary during known risky release (learned hard way).
Explore regional follow-the-sun with APAC contractor for true night coverage — cost vs. comp days trade study.
On-call rotation is capacity planning for human attention. Design it like you'd design queue depth — infinite buffer doesn't exist.
PagerDuty config snippets
- Escalation policy: primary 15 min → secondary 10 min → staff
- Support hours: none — global customers
- DND override: only CTO for legal/compliance pages
Low-urgency route to Slack #on-call-low — no phone push for disk 70% warnings.
Vacation coverage
Minimum two people trained per domain (DB, firmware OTA, API). Vacation blackouts require named backup in calendar event — not "team will cover."
Handoff metrics we track
- Pages during week / pages during prior week — detect drift
- Mean time to ack / resolve — personal baseline, not leaderboard punishment
- Comp days used vs accrued — managers enforce comp day actually taken
Six-month review: rotation v2 reduced ack misses; resolve time flat — next improvement target secondary role training depth.
What I'd do next
Manish Bookreader
Electronics enthusiast, Embedded Systems Expert, Linux/Networking programmer, and Software Engineer passionate about AI, electronics, books, and cooking.
