ServiceNow Security Engineer

CACI International

3d•$105,100 - $231,100

About The Position

CACI is seeking a ServiceNow Security Engineer to support the security of its ServiceNow platform. The role reports to the ServiceNow Program Manager and works closely with the ServiceNow Platform Team. The position focuses on governance and compliance, platform security and hardening, continuous monitoring, vulnerability management, audit support, incident response, identity and access governance, secure development, and security documentation. The engineer will collaborate with system owners, ISSOs, platform administrators, developers, and solution architects to implement controls and address findings in a complex federal environment.

Requirements

Ability to obtain Department of Homeland Security (DHS) Entry On Duty (EOD).
B.A./B.S. or equivalent plus 15 years of relevant experience.
Experience supporting ServiceNow development.
Understanding of NIST SP 800-53, RMF, FedRAMP, and federal security control frameworks.
Hands-on experience supporting ATO packages, SSP development, control implementation statements, and evidence collection.
Experience performing security assessments, vulnerability analysis, risk assessments, and remediation tracking.

Nice To Haves

CISSP, CCSP, CEH, CySA+, or AWS/Azure security certification is highly desired.

Responsibilities

Perform governance, compliance, and assurance activities to align the ServiceNow platform with NIST SP 800-53, NIST RMF, and FedRAMP requirements across environments and instances.
Define, document, and assess security requirements; support control selection, tailoring, and technical implementation for ServiceNow configurations and workflows.
Configure and enforce ServiceNow instance security controls, including ACLs, RBAC, encryption, IP restrictions, and security properties aligned with the ServiceNow Hardening Guide.
Configure and monitor ServiceNow security telemetry and maintain enterprise SIEM integrations for monitoring, alert correlation, and incident detection.
Support continuous monitoring for the ServiceNow boundary, including automated evidence gathering, control validation, and recurring assessments.
Manage the platform POA&M lifecycle by documenting findings, assigning owners, tracking milestones, validating remediation, and closing security items.
Develop and maintain ServiceNow ATO packages, including SSPs, boundary diagrams, control implementation summaries, and evidence artifacts.
Support security assessments and coordinate with SCAs, federal auditors, and 3PAOs during formal evaluations.
Collaborate with system owners, ISSOs, platform administrators, developers, and solution architects to implement controls and remediate findings.
Manage platform and integration vulnerabilities by reviewing patch levels and CVEs, prioritizing remediation, and tracking resolution.
Validate and enforce secure configuration baselines using the ServiceNow Instance Security Center and applicable benchmarks such as CIS benchmarks and DISA STIGs.
Assist with incident response involving the ServiceNow environment, including triage, root-cause investigation, containment, and reporting.
Analyze ServiceNow transaction and system logs and administrative audit trails to detect anomalous activity and support federal logging compliance.
Oversee ServiceNow access controls, privileged access management, SSO/MFA configurations, and periodic access recertifications.
Maintain configuration integrity and asset visibility in the ServiceNow CMDB in accordance with RMF inventory and categorization standards.
Develop and maintain security architecture documentation, SOPs, and operational playbooks for platform security administration.
Plan and execute deployment, upgrade, and maintenance projects for ServiceNow security capabilities, modules, and platform updates.
Perform risk assessments and security impact evaluations for change requests, plugins, update sets, custom integrations, and policy exceptions.
Support secure development for custom ServiceNow applications and catalog items, including security reviews of scripts and automated test pipelines.
Use threat intelligence to refine security workflows, identify emerging platform threats, and improve incident containment playbooks.
Track and report security posture metrics, including hardening scores, remediation timelines, POA&M aging, and audit compliance rates, using ServiceNow dashboards and reporting tools.