Senior Security Engineer – ServiceNow Security & Threat Modelling

Job description

<h2 style="margin-top:20px; margin-bottom:20px"><span style="font-size:16pt"><span style="line-height:116%"><span style="font-family:"Aptos Display",sans-serif"><span style="color:#0f4761"><span style="font-weight:normal"><span lang="EN-US" style="font-size:12.0pt"><span style="line-height:116%"><span style="font-family:"Aptos",sans-serif">Senior Security Engineer – ServiceNow Security & Threat Modelling</span></span></span></span></span></span></span></span></h2> <h2 style="margin-top:20px; margin-bottom:20px"><span style="font-size:16pt"><span style="line-height:116%"><span style="font-family:"Aptos Display",sans-serif"><span style="color:#0f4761"><span style="font-weight:normal"><span lang="EN-US" style="font-size:12.0pt"><span style="line-height:116%"><span style="font-family:"Aptos",sans-serif">What you get to do in this role:</span></span></span></span></span></span></span></span></h2> <ul> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Drive security by design across ServiceNow GTM Product initiatives, delivering expert threat modelling and conducting security design reviews for new features, integrations, and enhancements.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Own the implementation and continuous improvement of Secure Development Lifecycle (SDLC) practices, focusing on early detection and mitigation of risks through thorough threat modelling.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Plan, execute, and maintain Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) across ServiceNow and all integrated components; champion automated security scanning and vulnerability triage.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Deep-dive into scan results, perform risk analysis, and work cross-functionally to prioritize remediation, ensuring vulnerabilities are addressed in a timely and sustainable manner.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Collaborate with engineering, devops, and platform teams to instill secure coding practices, delivering security education and best practice advice.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Lead or contribute to risk assessments, vendor reviews, and architectural guidance for projects built on or integrated with ServiceNow.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Document security findings, produce actionable reporting, and help track resolution of risks and vulnerabilities as part of ITIL-driven incident, problem, and change management processes.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Mentor internal teams on modern security tools, processes, and emerging threats to continuously strengthen ServiceNow platform posture.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Stay abreast of the latest security threats, research, and regulatory requirements to ensure compliance and protection of sensitive data.</span></span></span></li>
</ul> <h2 style="margin-top:20px; margin-bottom:20px"><span style="font-size:16pt"><span style="line-height:116%"><span style="font-family:"Aptos Display",sans-serif"><span style="color:#0f4761"><span style="font-weight:normal"><span lang="EN-US" style="font-size:12.0pt"><span style="line-height:116%"><span style="font-family:"Aptos",sans-serif">Qualifications</span></span></span></span></span></span></span></span></h2> <ul> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Minimum 6 years experience in application or cloud security engineering, with a consistent focus on secure design and risk reduction.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Demonstrable expertise in threat modelling frameworks and methodologies (e.g., STRIDE, PASTA, attack trees).</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Strong background in security design review for enterprise web applications, APIs, and integrations.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Hands-on, production experience with SAST and DAST tools-setup, configuration, analysis, and remediation (examples: Checkmarx, Veracode, Burp Suite, OWASP ZAP, etc).</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Mandatory hands-on experience working with ServiceNow's platform, security architecture, and application development ecosystem.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Strong troubleshooting and analytical skills to trace security bugs through complex, distributed systems.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">A passion for security, personal integrity, and a strong commitment to protecting customer data and privacy.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Skilled communicator able to convey technical risk clearly to engineers and management alike.</span></span></span></li>
</ul> <h2 style="margin-top:20px; margin-bottom:20px"><span style="font-size:16pt"><span style="line-height:116%"><span style="font-family:"Aptos Display",sans-serif"><span style="color:#0f4761"><span style="font-weight:normal"><span lang="EN-US" style="font-size:12.0pt"><span style="line-height:116%"><span style="font-family:"Aptos",sans-serif">Required Technical Qualifications</span></span></span></span></span></span></span></span></h2> <ul> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Extensive ServiceNow technical experience, including security configuration, platform administration, and integration patterns.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Proven expertise in security testing and automation for enterprise and cloud-native applications.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Deep understanding of authentication/authorization protocols (OAuth, SAML, SSO), secure API design, and access control implementation.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Working knowledge of scripting/programming languages commonly used in ServiceNow and web development (JavaScript, Python, etc).</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Strong grasp of modern web application architecture, common attack vectors, and industry standards (OWASP, NIST).</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Exposure to or experience with secure CI/CD pipelines, integrating security tools as part of automated workflows.</span></span></span></li>
</ul> <h2 style="margin-top:20px; margin-bottom:20px"><span style="font-size:16pt"><span style="line-height:116%"><span style="font-family:"Aptos Display",sans-serif"><span style="color:#0f4761"><span style="font-weight:normal"><span lang="EN-US" style="font-size:12.0pt"><span style="line-height:116%"><span style="font-family:"Aptos",sans-serif">Preferred Qualifications (Nice to Have)</span></span></span></span></span></span></span></span></h2> <ul> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Industry certifications such as CISSP, CEH, OSCP, CSSLP, or ServiceNow Certified Implementation Specialist.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Experience conducting code and architecture reviews for SaaS or large-scale enterprise systems.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Familiarity with security governance, compliance frameworks (ISO27001/2, SOC2, GDPR), and privacy impact assessments.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Experience with infrastructure security, cloud security (AWS/Azure/GCP), or hybrid architectures.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Knowledge of incident response, digital forensics, or penetration testing methodologies.</span></span></span></li> <li style="margin-top:16px; margin-bottom:16px; margin-left:8px"><span style="font-size:12pt"><span style="line-height:116%"><span style="font-family:Aptos,sans-serif">Experience with security monitoring, alerting, and integration with SIEM tools.</span></span></span></li>
</ul> <p style="margin-bottom:11px"> </p>

Required Skill Profession

Computer Occupations