Cyber ServiceNow SIR – Senior Business Process Consultant

Deloitte • Jersey City, NJ

173d • $105,400 - $207,800

About The Position

Deloitte is hiring a Senior Business Process Consultant for its Cyber ServiceNow Security Incident Response (SIR) practice. The role is part of Strategy, Growth, and Transformation within Enterprise Technology Strategy and Transformation, and supports clients in transforming cybersecurity programs and navigating the threat landscape through ServiceNow solutions.

The consultant owns the SIR process-design and development workstream, guiding clients from current-state processes, tools, and data toward ServiceNow-aligned architecture and practices. The work includes leading requirements and design workshops; developing incident-response processes, runbooks, severity and escalation models, major incident procedures, RACI matrices, SLAs, and KPIs; and translating findings into epics, user stories, functional designs, and other project artifacts. The consultant partners with technical consultants and solution architects on configuration, integrations, and data requirements, and manages workstream backlog, scope, schedule, dependencies, and risks.

The position also involves leading demonstrations, user acceptance testing, defect triage, training, cutover, and adoption planning; identifying appropriate uses for Now Assist and AI Specialists with human-in-the-loop controls; reviewing deliverable quality; mentoring team members; supporting project reporting and proposals; and contributing reusable practice assets. The role requires client-facing communication with technical and executive audiences and an average travel commitment of 50%. Recruiting for this role ends May 31, 2027.

Requirements

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Engineering, Information Technology, or Business Administration.
• At least 4 years supporting or leading ServiceNow implementation projects in a client-facing consulting role.
• At least 4 years gathering business requirements, leading workshops, and designing process flows and functional documentation.
• At least 3 years designing, configuring, or implementing ServiceNow Security Incident Response, including at least one full implementation.
• Working knowledge of SOC and incident-response operating processes.
• Experience leading a workstream and mentoring junior team members.
• Experience guiding clients from legacy tools and processes to ServiceNow out-of-the-box-aligned design and best practices.
• ServiceNow Certified System Administrator (CSA).
• Ability to travel an average of 50%, depending on the work and clients served.
• Self-starter who takes ownership of a workstream and delivers without close supervision.
• Strong analytical thinking and ability to identify core issues in complex situations.
• Resourceful problem-solving skills, including developing workable solutions without an established playbook.
• Advisory mindset and ability to explain trade-offs in plain language and recommend a ServiceNow-aligned approach.
• Collaborative leadership and ability to raise the performance of colleagues.
• Confident client-facing communication with technical and executive audiences.
• Meticulous attention to detail and quality.
• Ability to manage and prioritize multiple tasks in a fast-paced environment.
• Ability to mentor others and provide clear guidance.

Nice To Haves

• ServiceNow Certified Application Developer (CAD).
• ServiceNow Certified Implementation Specialist – Security Incident Response (CIS-SIR).
• Architecture Excellence (ArchX).
• Experience with Threat Intelligence Security Center (TISC).
• Experience applying NIST 800-61, NIST CSF, ISO 27001, or MITRE ATT&CK in process or platform design.
• Experience integrating ServiceNow with SIEM, EDR, or SOAR tools.
• Experience with Now Assist for Security Operations, AI Specialists, or Performance Analytics.
• Experience migrating from another case-management or SOAR platform.

Responsibilities

• Lead requirements and design workshops and stakeholder interviews with SOC, incident response, threat intelligence, and IT operations leaders.
• Guide client stakeholders through migration from current-state processes, tools, and data to ServiceNow-aligned architecture, including out-of-the-box adoption, customization trade-offs, and capability sequencing.
• Own process assessment and design, including response runbooks, severity and escalation models, major incident procedures, RACI, SLAs, and KPIs.
• Develop epics and user stories from workshops and process-design sessions in collaboration with business process consultants and solution architects.
• Drive SIR functional design decisions for alert-to-incident logic, playbooks and flows, TISC enrichment, assignment, post-incident reviews, dashboards, and access models; document designs and user stories.
• Document requirements, RACI matrices, data flows, and integration needs for SIEM, EDR, TISC, other threat intelligence sources, and CMDB touchpoints.
• Produce process flows, functional designs, test scenarios, training materials, and release notes.
• Identify opportunities to use Now Assist and AI Specialists, including agentic incident response, to reduce manual triage and investigation; define human-in-the-loop approval processes.
• Define integration and data requirements for SIEM, EDR, SOAR, TISC, other threat feeds, and CMDB in partnership with technical leads.
• Develop the workstream backlog and work directly with technical consultants configuring ServiceNow for client requirements.
• Manage day-to-day agile activities, including user story assignment, backlog grooming, sprint preparation, and story refinement.
• Assist with project-management reporting, track workstream and project dependencies, and raise risks appropriately.
• Review and quality-check consultants’ deliverables; mentor and coach team members.
• Manage workstream scope, timeline, and risks, escalating early with recommendations to engagement managers and senior leadership.
• Lead show-back demonstrations, UAT, defect triage, training, cutover, and adoption planning.
• Contribute to proposals, estimates, and reusable practice assets.

Benefits

• Potential eligibility to participate in a discretionary annual incentive program.
• Professional development opportunities, including on-the-job learning, formal development programs, leadership opportunities, and mentorship.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior