Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)

ServiceNow•Santa Clara, CA

About The Position

ServiceNow seeks a senior staff-level product security engineer to serve as a senior technical authority within its Product Security Incident Response Team (PSIRT). PSIRT handles awareness, response, and investigation of post-release vulnerabilities in ServiceNow-developed products and service offerings. The role addresses significant platform security issues that require expert judgment, leading deep-dive investigations and coordinating resolution across engineering, product, and release teams. It calls for calm, decisive leadership during security events and fluency with product development cycles and engineering and product relationships to drive fixes to completion under incident pressure. The engineer will help shape ServiceNow’s product vulnerability response and strengthen the technical rigor of the response capability. The stated coverage schedule is Sunday–Monday, Monday–Tuesday, and Tuesday–Wednesday from 18:00 to 02:00 UTC; Friday–Saturday from 19:00 to 02:00 UTC; and Saturday–Sunday from 17:00 to 02:00 UTC. Coverage may change based on business needs, and additional coverage outside these hours may be required for significant incidents. The position includes leading incident response and remediation, managing CVE assignment and coordinated disclosure, and driving post-incident learning and continuous improvement. The engineer works with incident commanders, security leadership, engineering, product, release, customer-facing teams, external security partners, vendors, and researchers.

Requirements

Experience leveraging or critically evaluating how to integrate AI into work processes, decision-making, or problem-solving.
At least 12 years of related experience with a bachelor’s degree; 8 years with a master’s degree; 5 years with a PhD; or equivalent experience.
At least 5 years auditing source code for security vulnerabilities.
Demonstrated leadership during significant security events or major incidents and willingness to participate in on-call.
Ability to read and comprehend Java and JavaScript code.
Strong understanding of common Java and JavaScript vulnerabilities.
Proficiency scripting in both Python and JavaScript for data gathering, processing, and visualization.
Experience developing proof-of-concept exploits for web application vulnerabilities.
Ability to communicate complex security risk clearly in writing and verbally to technical teams and leadership.
Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
Proficiency in deep-dive product security investigations and root-cause analysis spanning design, code, configuration, and operational layers.
Experience with exploit analysis and proof-of-concept development to distinguish real exploitability from theoretical risk.
Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
Experience leading a CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication.

Nice To Haves

Experience in a PSIRT or similar function for a major software or SaaS platform.
Recognized expertise in product security incident response, vulnerability research, or application security within a software or SaaS environment.
Experience conducting vulnerability assessments on the ServiceNow platform.
Experience with emerging threats, including AI-specific attack vectors, software supply chain security, and SDLC tooling security.
Experience with cloud infrastructure such as AWS, Azure, or GCP and containerized environments.
Relevant security certifications such as OSWE, or demonstrated equivalent expertise.

Responsibilities

Demonstrate technical and organizational leadership during significant security events, providing structure and clear decision-making under pressure.
Partner with incident commanders, business information security leadership, engineering, and customer-facing teams to maintain clear ownership, prioritize workstreams, and coordinate hand-offs.
Drive coordinated response across affected releases, balancing risk and remediation feasibility.
Use knowledge of product development cycles and engineering/product partnerships to move fixes through the release pipeline.
Verify fix completeness and guard against incomplete mitigations before release.
Lead ServiceNow’s CVE disclosure process, including CVE assignment, scoring, advisory content, and publication timing.
Coordinate disclosures with external security partners, vendors, and researchers, aligning timelines and messaging.
Review external advisories, researcher write-ups, and joint disclosure content for technical accuracy before publication.
Represent PSIRT’s technical position in coordinated disclosures and researcher engagements.
Author postmortems and drive lessons learned to closure after product security incidents.
Participate in retrospectives following significant product security events and turn findings into concrete process and technical improvements.
Contribute to partner-team tracking of product security risk themes and trends across the portfolio.
Feed incident learnings into SDLC improvements and secure development practices.