Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)

ServiceNow•Santa Clara, CA

1d•$201,300 - $352,300

About The Position

ServiceNow is seeking a senior staff-level product security engineer to serve as a senior technical authority within its Product Security Incident Response Team (PSIRT). PSIRT handles awareness, response, and investigation of post-release vulnerabilities in ServiceNow-developed products and service offerings. The role leads deep-dive investigations, coordinates resolution across engineering, product, and release teams, and provides calm, decisive leadership during significant security events. The engineer will help shape ServiceNow’s product vulnerability response at scale and strengthen the technical rigor of the response capability. The role is responsible for leading incident response and reducing exposure windows by coordinating fixes across affected releases, navigating product development and release processes, and verifying that fixes and mitigations are complete. It also leads CVE assignment, scoring, advisory preparation, and publication timing; coordinates disclosures with external partners, vendors, and researchers; and reviews disclosure materials for technical accuracy. The position contributes to postmortems, retrospectives, risk-theme tracking, and improvements to secure development practices. Coverage is scheduled for Sunday–Monday, Monday–Tuesday, and Tuesday–Wednesday from 18:00 to 02:00 UTC; Friday–Saturday from 19:00 to 02:00 UTC; and Saturday–Sunday from 17:00 to 02:00 UTC. Coverage may change, and additional coverage outside these hours may be required during significant incidents. The role includes on-call participation. The position offers a base pay range of $201,300–$352,300, plus equity when applicable, variable or incentive compensation, and benefits. The stated base-pay range is a guideline; compensation varies based on qualifications, skills, competencies, and work location. Work persona is Flexible.

Requirements

At least 12 years of related experience with a bachelor's degree; or 8 years with a master's degree; or a Ph.D. with 5 years of experience; or equivalent experience.
At least 5 years auditing source code for security vulnerabilities.
Demonstrated leadership during significant security events or major incidents, and willingness to participate in on-call.
Ability to read and comprehend Java and JavaScript code.
Strong understanding of common Java and JavaScript vulnerabilities.
Proficiency scripting in both Python and JavaScript for data gathering, processing, and visualization.
Experience developing proof-of-concept exploits for web application vulnerabilities.
Ability to communicate complex security risks clearly in writing and verbally to technical teams and leadership.
Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
Proficiency in deep-dive product security investigations and root-cause analysis across design, code, configuration, and operational layers.
Ability to analyze exploits and develop proof-of-concept demonstrations that distinguish real exploitability from theoretical risk.
Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
Experience leading a CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication.
Experience leveraging or critically considering how to integrate AI into work processes, decision-making, or problem-solving.

Nice To Haves

Experience in a PSIRT or similar function for a major software or SaaS platform.
Recognized expertise in product security incident response, vulnerability research, or application security within a software or SaaS environment.
Experience conducting vulnerability assessments on the ServiceNow platform.
Experience with emerging threats, including AI-specific attack vectors, software supply chain security, and SDLC tooling security.
Experience with cloud infrastructure such as AWS, Azure, or GCP and containerized environments.
Relevant security certifications such as OSWE, or demonstrated equivalent expertise.

Responsibilities

Provide technical and organizational leadership during significant security events, establishing structure and clear decision-making under pressure.
Partner with incident commanders, business information security leadership, engineering, and customer-facing teams to maintain ownership, prioritize workstreams, and manage hand-offs.
Drive coordinated responses across affected releases, balancing risk and remediation feasibility to reduce exposure windows.
Use knowledge of product development cycles and engineering/product partnerships to move fixes through the release pipeline.
Verify fix completeness and prevent incomplete mitigations from being released.
Lead the CVE disclosure process, including CVE assignment, scoring, advisory content, and publication timing.
Coordinate disclosures with external security partners, vendors, and researchers, aligning timelines and messaging.
Review external advisories, researcher write-ups, and joint disclosure content for technical accuracy before publication.
Represent PSIRT's technical position in coordinated disclosures and researcher engagements.
Author postmortems and drive lessons learned to closure after product security incidents.
Participate in retrospectives following significant product security events and translate findings into process and technical improvements.
Contribute to tracking product security risk themes and trends across the portfolio.
Feed incident learnings upstream into SDLC improvements and secure development practices.
Participate in on-call coverage and provide additional coverage when significant incidents require it.