Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)

ServiceNow•Santa Clara, CA

15h

About The Position

ServiceNow seeks a senior staff-level product security engineer to serve as a senior technical authority within its Product Security Incident Response Team (PSIRT). PSIRT handles awareness, response, and investigation for post-release vulnerabilities in ServiceNow-developed products and service offerings. The role leads investigations and coordinates resolution across engineering, product, and release teams, providing calm, decisive leadership during significant security events. The engineer will help shape ServiceNow’s product vulnerability response and strengthen the technical rigor of its response capability. The stated coverage schedule is Sunday–Monday, Monday–Tuesday, and Tuesday–Wednesday from 18:00 to 02:00 UTC; Friday–Saturday from 19:00 to 02:00 UTC; and Saturday–Sunday from 17:00 to 02:00 UTC. Coverage may change based on business needs, and additional hours may be required during significant incidents. The role requires willingness to participate in on-call coverage. The position leads coordinated incident response, manages CVE assignment, scoring, advisory content, and publication timing, works with external security partners and researchers on coordinated disclosures, and drives post-incident improvements. It also contributes incident learnings to secure development practices and broader product security risk tracking.

Requirements

Experience leveraging or critically evaluating how to integrate AI into work processes, decision-making, or problem-solving.
At least 12 years of related experience with a bachelor’s degree, 8 years with a master’s degree, 5 years with a Ph.D., or equivalent experience.
At least 5 years auditing source code for security vulnerabilities.
Demonstrated leadership during significant security events or major incidents and willingness to participate in on-call.
Ability to read and comprehend Java and JavaScript code.
Strong understanding of common Java and JavaScript vulnerabilities.
Proficiency scripting in Python and JavaScript for data gathering, processing, and visualization.
Ability to develop proof-of-concept exploits for web application vulnerabilities.
Ability to communicate complex security risks clearly in writing and verbally to technical teams and leadership.
Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
Proficiency in deep-dive product security investigations and root-cause analysis across design, code, configuration, and operational layers.
Exploit analysis and proof-of-concept development that distinguishes actual exploitability from theoretical risk.
Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
Experience leading a CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication.

Nice To Haves

Experience in a PSIRT or similar function for a major software or SaaS platform.
Recognized expertise in product security incident response, vulnerability research, or application security in a software or SaaS environment.
Experience conducting vulnerability assessments on the ServiceNow platform.
Experience with emerging threats, including AI-specific attack vectors, software supply chain security, and SDLC tooling security.
Experience with cloud infrastructure such as AWS, Azure, or GCP and containerized environments.
Relevant security certifications such as OSWE, or demonstrated equivalent expertise.

Responsibilities

Provide technical and organizational leadership during significant security events, establishing structure and clear decision-making under pressure.
Partner with incident commanders, business information security leadership, engineering, and customer-facing teams to maintain ownership, workstream priorities, and hand-offs.
Drive coordinated responses across affected releases, balancing risk and remediation feasibility.
Use knowledge of product development cycles and engineering/product partnerships to move fixes through release pipelines.
Verify fix completeness and prevent incomplete mitigations from being released.
Lead ServiceNow’s CVE disclosure process, including CVE assignment, scoring, advisory content, and publication timing.
Coordinate disclosures with external security partners, vendors, and researchers, aligning timelines and messaging.
Review external advisories, researcher write-ups, and joint disclosure content for technical accuracy.
Represent PSIRT’s technical position in coordinated disclosures and researcher engagements.
Author postmortems and drive lessons learned to closure after product security incidents.
Participate in retrospectives and translate findings into concrete process and technical improvements.
Contribute to tracking product security risk themes and trends across the portfolio.
Feed incident learnings into SDLC improvement and secure development practices.