Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)

ServiceNow•Kirkland, WA

1d•$201,300 - $352,300

About The Position

ServiceNow seeks a senior staff-level product security engineer to serve as a senior technical authority within its Product Security Incident Response Team (PSIRT). PSIRT handles awareness, response, and investigation of post-release vulnerabilities in ServiceNow-developed products and service offerings. The role leads investigations into significant security issues, coordinates resolution across engineering, product, and release teams, and provides calm, decisive leadership during major security events. The engineer will help shape ServiceNow’s product vulnerability response and strengthen the technical rigor of the response capability. The role includes scheduled coverage during specified UTC hours, with coverage subject to change based on business needs. Additional coverage outside the stated hours may be required during significant incidents. The position also requires willingness to participate in on-call coverage. ServiceNow’s Security Organization develops security solutions to reduce risk, protect the company and its customers, and support secure migration of sensitive data and workloads to the cloud.

Requirements

Experience leveraging or critically evaluating how to integrate AI into work processes, decision-making, or problem-solving.
At least 12 years of related experience with a bachelor's degree, 8 years with a master's degree, 5 years with a PhD, or equivalent experience.
At least 5 years auditing source code for security vulnerabilities.
Demonstrated leadership during significant security events or major incidents, and willingness to participate in on-call.
Ability to read and comprehend Java and JavaScript code.
Strong understanding of common Java and JavaScript vulnerabilities.
Proficiency scripting in Python and JavaScript for data gathering, processing, and visualization.
Experience developing proof-of-concept exploits for web application vulnerabilities.
Ability to communicate complex security risks clearly in writing and verbally to technical teams and leadership.
Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
Proficiency in deep-dive product security investigations and root-cause analysis across design, code, configuration, and operational layers.
Experience analyzing exploits and developing proof-of-concept demonstrations to distinguish real exploitability from theoretical risk.
Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
Experience leading a CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication.

Nice To Haves

Experience in a PSIRT or similar function for a major software or SaaS platform.
Recognized expertise in product security incident response, vulnerability research, or application security in a software or SaaS environment.
Experience conducting vulnerability assessments on the ServiceNow platform.
Experience with emerging threats, including AI-specific attack vectors, software supply chain security, and SDLC tooling security.
Experience with cloud infrastructure such as AWS, Azure, or GCP, and containerized environments.
Relevant security certifications such as OSWE, or demonstrated equivalent expertise.

Responsibilities

Provide technical and organizational leadership during significant security events, bringing structure and clear decision-making under pressure.
Partner with incident commanders, business information security leadership, engineering, and customer-facing teams to maintain ownership, prioritize workstreams, and manage hand-offs.
Coordinate response across affected releases, balancing risk and remediation feasibility to reduce the exposure window.
Use knowledge of product development cycles and engineering/product partnerships to move fixes through the release pipeline.
Verify that fixes are complete and prevent incomplete mitigations from being released.
Lead the CVE disclosure process, including CVE assignment, scoring, advisory content, and publication timing.
Coordinate disclosures with external security partners, vendors, and researchers, aligning timelines and messaging.
Review external advisories, researcher write-ups, and joint disclosure content for technical accuracy.
Represent PSIRT’s technical position in coordinated disclosures and researcher engagements.
Author postmortems and drive lessons learned to closure after product security incidents.
Participate in retrospectives and translate findings into process and technical improvements.
Contribute to tracking product security risk themes and trends across the portfolio.
Feed incident learnings into SDLC improvements and secure development practices.