Cyber ServiceNow SecOps/SIR – Senior Business Process Consultant

Deloitte • Jersey City, NJ

173d • $105,400 - $207,800

About The Position

Deloitte’s Cyber team helps clients address cybersecurity challenges through solutions and managed services that simplify complexity and support resilience. Within Cyber Strategy & Transformation, this consultant will lead the business process design workstream for ServiceNow Security Incident Response (SIR) engagements. The role works with client SOC, incident response, threat intelligence, and IT operations stakeholders to assess current processes and design future-state processes, architecture, and platform capabilities aligned with ServiceNow best practices.

The consultant will guide clients through migration decisions, define requirements and functional designs, and work closely with technical consultants and solution architects to configure ServiceNow for client needs. The position also involves managing workstream delivery, agile activities, quality, risks, scope, and timelines; mentoring team members; leading demonstrations, UAT, cutover, and adoption planning; and contributing to proposals and reusable practice assets. The role is available in multiple listed U.S. locations. Recruiting for this role ends on 05/31/2027, and travel averages 50%.

Requirements

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Engineering, Information Technology, or Business Administration.
• 4+ years supporting or leading ServiceNow implementation projects in a client-facing consulting role.
• 4+ years gathering business requirements, leading workshops, and designing process flows and functional documentation.
• 3+ years designing, configuring, or implementing ServiceNow Security Incident Response, including at least one full implementation.
• Working knowledge of SOC and incident response operating processes.
• Experience leading a workstream and mentoring junior team members.
• Experience guiding clients from legacy tools and processes to ServiceNow out-of-the-box-aligned design and best practices.
• ServiceNow Certified System Administrator (CSA).
• Ability to travel 50% on average, based on work performed and clients and industries served.
• Self-starter who takes ownership of a workstream and delivers without close supervision.
• Analytical thinking and the ability to identify core issues in complex situations.
• Resourceful problem-solving skills, including building workable solutions without an existing playbook.
• Advisory mindset, including the ability to explain trade-offs in plain language and recommend a ServiceNow-aligned path.
• Collaborative leadership and the ability to improve team performance.
• Confident client-facing communication with technical and executive audiences.
• Meticulous attention to detail and quality.
• Ability to manage and prioritize multiple tasks in a fast-paced environment.
• Ability to mentor others and provide clear guidance.

Nice To Haves

• ServiceNow Certified Application Developer (CAD).
• ServiceNow Certified Implementation Specialist – Security Incident Response (CIS-SIR).
• Architecture Excellence (ArchX).
• Experience with Threat Intelligence Security Center (TISC).
• Experience applying NIST 800-61, NIST CSF, ISO 27001, or MITRE ATT&CK in process or platform design.
• Experience integrating ServiceNow with SIEM, EDR, or SOAR tools.
• Experience with Now Assist for Security Operations, AI Specialists, or Performance Analytics.
• Experience migrating from another case management or SOAR platform.

Responsibilities

• Lead requirements and design workshops and stakeholder interviews with SOC, incident response, threat intelligence, and IT operations leaders.
• Guide client stakeholders through migration from current-state processes, tools, and data to ServiceNow-aligned architecture, including out-of-the-box adoption, customization trade-offs, and capability sequencing.
• Own process design and development, including current-state assessment, future-state design, response runbooks, severity and escalation models, major incident procedures, RACI, SLAs, and KPIs.
• Develop epics and user stories from workshops and process design sessions in collaboration with business process consultants and solution architects.
• Drive functional design decisions for SIR, including alert-to-incident logic, playbooks and flows, TISC enrichment, assignment, post-incident reviews, dashboards, and access models; document decisions in user stories and design documentation.
• Document requirements, RACI matrices, data flows, and integration needs involving SIEM, EDR, TISC, other threat intelligence sources, and the CMDB.
• Produce process flows, functional designs, test scenarios, training materials, and release notes.
• Identify opportunities for Now Assist and AI Specialists, including agentic incident response, to reduce manual triage and investigation, and define human-in-the-loop approval processes.
• Define integration and data requirements for SIEM, EDR, SOAR, TISC, other threat feeds, and the CMDB in partnership with technical leads.
• Develop the workstream backlog and work directly with technical consultants configuring ServiceNow to client-specific needs.
• Manage day-to-day agile activities, including user story assignment, backlog grooming, sprint preparation, and story refinement.
• Assist with project management reporting, track workstream and project-wide dependencies, and raise appropriate risks.
• Review and quality-check consultant deliverables; mentor and coach team members.
• Manage workstream scope, timeline, and risks, escalating early with recommendations to engagement managers and senior leadership.
• Lead show-back demonstrations, UAT, defect triage training, cutover, and adoption planning.
• Contribute to proposals, estimates, and reusable practice assets.

Benefits

• Discretionary annual incentive program, subject to program rules and applicable factors.
• Professional development opportunities, including on-the-job learning, formal development programs, leadership opportunities, and mentorship.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior