This is a remote position.

ServiceNow SecOps Specialist

Job Details

Employment Type: Contract
Work Mode: Remote
Location: Offshore
Total Experience Required: 4 to 8 years
Relevant Experience Required: 3+ years of dedicated implementation and configuration experience across ServiceNow Security Operations (SecOps) modules
Mandatory Certification: ServiceNow Certified Implementation Specialist – Security Incident Response (CIS-SIR) or Vulnerability Response (CIS-VR)

Job Summary
We are seeking an experienced ServiceNow SecOps Specialist to bridge the gap between enterprise security tools and automated workflow orchestration. The ideal candidate will design, configure, and optimize Security Incident Response (SIR) and Vulnerability Response (VR) modules, building robust ingestion pipelines that ingest security threat telemetry into actionable, prioritized, and automated remediation workflows.

Key Responsibilities

Configure and manage core ServiceNow SecOps modules, focusing on Security Incident Response (SIR), Vulnerability Response (VR), and Threat Intelligence integration.
Design automated ingestion pipelines via Integration Hub, connecting ServiceNow with external SIEMs (e.g., Splunk, Sentinel), EDRs (e.g., CrowdStrike), and vulnerability scanners (e.g., Tenable, Qualys).
Build complex security orchestration and playbooks within Flow Designer to automate initial validation containment tasks, asset lookups, and owner assignments.
Implement Vulnerability Assignment Rules and Calculator Groups, prioritizing vulnerabilities dynamically using corporate asset criticality ratings and CVSS threat matrices.
Establish strict data confidentiality controls, managing Access Control Lists (ACLs), read-permissions, and data isolation barriers to keep sensitive breach investigations restricted to authorized teams.
Govern Configuration Item (CI) reconciliation matches, collaborating with CMDB data stewards to ensure incoming security event data maps correctly to existing infrastructure assets.
Support end-to-end user acceptance testing (UAT), creating target test failure patterns, verifying playbook action workflows, and delivering analyst enablement training workshops.

Requirements

4 to 8 years of core enterprise IT or cybersecurity experience, with 3+ dedicated years actively designing, building, and maintaining configurations within the ServiceNow SecOps application suite.
Strong technical mastery of JavaScript scripting, Flow Designer parameters, ServiceNow Glide API frameworks, JSON parsing structures, and REST/SOAP endpoint mappings.
Deep structural understanding of cybersecurity incident response phases (NIST/SANS), the MITRE ATT&CK framework, common infrastructure vulnerability vectors, and CMDB hierarchy frameworks.
Mandatory certification: ServiceNow CIS-SIR or CIS-VR.

Preferred Qualifications

CompTIA Security+, CEH (Certified Ethical Hacker), or GCIH (GIAC Certified Incident Handler) designation.
Prior experience implementing ServiceNow Major Security Incident Management (MSIM) frameworks or handling multi-tenant domain separation configurations.

Competências necessárias

ServiceNow Security Incident Response (SIR) configuration and managementServiceNow Vulnerability Response (VR) configuration and managementServiceNow Threat Intelligence integrationIntegration Hub and integrations with SIEM/EDR/vulnerability scanners (Splunk, Sentinel, CrowdStrike, Tenable, Qualys)Flow Designer security orchestration and playbook developmentVulnerability prioritization using Vulnerability Assignment Rules, Calculator Groups, CVSS and asset criticalityAccess Control Lists (ACLs), data confidentiality controls and data isolation in ServiceNowCMDB reconciliation, CI matching and collaboration with CMDB data stewardsJavaScript scripting, ServiceNow Glide API, JSON parsing and REST/SOAP endpoint mappingsIncident response frameworks (NIST/SANS) and MITRE ATT&CK knowledgeServiceNow Certified Implementation Specialist – CIS-SIR or CIS-VR (mandatory certification)User acceptance testing (UAT) support and analyst enablement/training workshopsServiceNow Major Security Incident Management (MSIM) and domain separation experience

Vagas similares