Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)

ServiceNow•San Diego, CA

1d•$181,200 - $317,100

About The Position

ServiceNow seeks a senior staff-level product security engineer to serve as a senior technical authority within its Product Security Incident Response Team (PSIRT). PSIRT handles awareness, response, and investigation of post-release vulnerabilities in ServiceNow-developed products and service offerings. The role involves independently and collaboratively addressing significant platform security issues that require judgment, leading deep-dive investigations, coordinating resolutions across engineering, product, and release teams, and providing decisive leadership during security events. The successful candidate will apply an understanding of product development cycles and engineering and product relationships to lead fixes through completion under incident pressure. The role will help shape ServiceNow’s response to product security vulnerabilities at scale and strengthen the technical rigor of the response capability. The stated coverage schedule is Sunday–Monday, Monday–Tuesday, and Tuesday–Wednesday from 18:00 to 02:00 UTC; Friday–Saturday from 19:00 to 02:00 UTC; and Saturday–Sunday from 17:00 to 02:00 UTC. Coverage may change, and additional coverage outside these hours may be required for significant incidents.

Requirements

Experience leveraging or critically evaluating how to integrate AI into work processes, decision-making, or problem-solving.
At least 12 years of related experience with a bachelor’s degree, 8 years with a master’s degree, 5 years with a PhD, or equivalent experience.
At least 5 years of auditing source code for security vulnerabilities.
Demonstrated leadership during significant security events or major incidents, and willingness to participate in on-call.
Ability to read and comprehend Java and JavaScript code.
Strong understanding of common Java and JavaScript vulnerabilities.
Proficiency in Python and JavaScript scripting for data gathering, processing, and visualization.
Experience developing proof-of-concept exploits for web application vulnerabilities.
Ability to communicate complex security risks clearly in writing and verbally to technical teams and leadership.
Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
Proficiency in deep-dive product security investigations and root-cause analysis across design, code, configuration, and operational layers.
Exploit analysis and proof-of-concept development skills to distinguish actual exploitability from theoretical risk.
Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
Experience leading a CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication.

Nice To Haves

Experience in a PSIRT or similar function for a major software or SaaS platform.
Recognized expertise in product security incident response, vulnerability research, or application security in a software or SaaS environment.
Experience conducting vulnerability assessments on the ServiceNow platform.
Experience with emerging threats, including AI-specific attack vectors, software supply chain security, and SDLC tooling security.
Experience with cloud infrastructure such as AWS, Azure, or GCP, and containerized environments.
Relevant security certifications such as OSWE, or demonstrated equivalent expertise.

Responsibilities

Provide technical and organizational leadership during significant security events, bringing structure and clear decision-making under pressure.
Partner with incident commanders, business information security leadership, engineering, and customer-facing teams to maintain ownership, prioritize workstreams, and manage hand-offs.
Drive coordinated response across affected releases, balancing risk and remediation feasibility to reduce the exposure window.
Use knowledge of product development cycles and engineering/product partnerships to move fixes through the release pipeline.
Verify fix completeness and prevent incomplete mitigations from being released.
Lead ServiceNow’s CVE disclosure process, including CVE assignment, scoring, advisory content, and publication timing.
Coordinate disclosures with external security partners, vendors, and researchers, aligning timelines and messaging.
Review external advisories, researcher write-ups, and joint disclosure content for technical accuracy.
Represent PSIRT’s technical position in multi-party disclosures and researcher engagements.
Author postmortems and drive lessons learned to closure after product security incidents.
Participate in retrospectives following significant product security events and translate findings into process and technical improvements.
Contribute to partner teams’ tracking of product security risk themes and trends across the portfolio.
Feed incident learnings into SDLC improvements and secure development practices.