Cyber ServiceNow SecOps/ SIR – Business Process Consultant
About The Position
Deloitte’s Cyber team delivers cybersecurity solutions and managed services that help clients navigate evolving threats, operate resiliently, and manage security proactively. The Cyber Strategy & Transformation offering develops and transforms cyber programs in line with clients’ strategic objectives, regulatory requirements, and risk appetite, including capabilities across ServiceNow SecOps, Integrated Risk Management, and IT Asset Management. The Business Process Consultant will work with security operations center (SOC), incident response, and threat intelligence teams to define and improve processes using ServiceNow Security Incident Response (SIR). The role involves facilitating discovery and requirements work, mapping incident processes and supporting systems to ServiceNow capabilities, supporting functional design and configuration, and coordinating delivery activities through testing and release. The role requires an average of 50% travel, depending on the work and clients served. Recruiting for this role ends on 05/31/2027.
Requirements
- Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Engineering, Information Technology, or Business Administration.
- ServiceNow Certified System Administrator (CSA).
- At least 2 years supporting ServiceNow implementation projects in a client-facing consulting role.
- At least 2 years gathering business requirements, facilitating workshops, and documenting process flows or user stories.
- At least 2 years designing, configuring, or implementing ServiceNow Security Incident Response (SIR).
- Experience supporting SOC and incident response processes.
- Ability to travel 50% on average, based on the work performed and the clients and industries or sectors served.
- Ability to work independently and collaboratively.
- Effective written and verbal communication skills.
- Meticulous attention to detail and quality of work product.
- Ability to build and sustain professional relationships.
- Ability to manage and prioritize multiple tasks in a fast-paced, dynamic environment.
- Strong interpersonal skills and professional demeanor.
- Ability to meet deadlines.
- Limited immigration sponsorship may be available.
Nice To Haves
- ServiceNow Certified Application Developer (CAD), ServiceNow Certified Implementation Specialist – Security Incident Response (CIS-SIR), or Architecture Excellence (ArchX) credential.
- Experience with ServiceNow Major Security Incident Management, Data Loss Prevention, or Threat Intelligence Security Center (TISC) applications.
- Experience applying NIST Special Publication 800-61, the NIST Cybersecurity Framework (CSF), or MITRE ATT&CK.
- Experience integrating ServiceNow with SIEM or EDR tools, including Splunk, Microsoft Sentinel, CrowdStrike, or Microsoft Defender.
- Experience using Now Assist for Security Operations.
- Experience as a SOC analyst or incident responder.
Responsibilities
- Facilitate workshops, stakeholder interviews, and requirements gathering with SOC, incident response, and threat intelligence teams.
- Document current-state and future-state processes based on ServiceNow out-of-the-box principles.
- Map incident lifecycles, supporting tools, and data to ServiceNow SIR capabilities and data models, identifying gaps and migration considerations.
- Develop epics, user stories, requirements, RACI matrices, data flows, and integration needs for SIEM, EDR, TISC, and CMDB platforms.
- Support functional design and configuration of the SIR workspace, incident forms and states, assignment and escalation rules, response tasks, playbooks, flows, notifications, SLAs, dashboards, roles, and access controls.
- Produce test scenarios, training materials, and release notes.
- Manage user story assignment, backlog grooming, sprint preparation, story refinement, demonstrations, user acceptance testing, defect triage, cutover, and risk tracking with engagement managers.
- Lead projects or workstreams and provide clear guidance to others.
Benefits
- May be eligible to participate in a discretionary annual incentive program, subject to program rules and applicable performance factors.
- Professional development opportunities, including on-the-job learning, formal development programs, leadership opportunities, and mentorship.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
