Staff Incident Response Engineer

ServiceNow

About The Position

This Staff Incident Response Engineer role is part of ServiceNow’s Cyber Investigation, Response & Automation Team and supports commercial and regulated-market customer environments in Canada. The engineer monitors tools and systems that protect ServiceNow’s production and regulated environments, correlates events, leads customer-impacting incident response, and works to improve response effectiveness while maintaining quality. The role supports a global security organization responsible for reducing risk and protecting ServiceNow and its customers. The position includes incident response, digital forensics, threat hunting, threat intelligence, security tooling, and security configuration work. The engineer produces post-incident and forensic reports, remediation plans, and response documentation; supports audits and regulatory investigations; and participates in an on-call rotation that may include after-hours, weekends, and statutory holidays to provide 24x7 operational support. Employment requires successful completion and maintenance of a Government of Canada Reliability Status screening, including five years of verifiable background history, identity and education verification, criminal record and credit checks. Candidates must be eligible to obtain and maintain Reliability Status, generally requiring Canadian citizenship or permanent resident status. The role may require security clearance in the future.

Requirements

6+ years of related experience or an equivalent combination of education and experience; the requirements section also specifies 7 to 10+ years of related experience or an equivalent mix of education and experience.
Experience integrating or critically evaluating AI in work processes, decision-making, or problem-solving, including use of AI-powered tools, workflow automation, or analysis of AI-driven insights.
Automation knowledge, including Python and bash scripting, and experience hardening Linux, Windows, or Mac systems.
Experience with data logging applications such as Splunk.
Knowledge of vulnerability-scanning tools such as Qualys or Nessus.
A defensive security mindset.
Ability to explain complex issues to executives and customers.
Experience working in Canadian regulated markets, such as financial services or the public sector, is highly desirable.
Deep understanding of Security Operations Center and security incident response protocols and procedures.
Extensive experience in incident response, digital forensics, threat hunting, and threat intelligence.
Solid networking foundation, including TCP/IP and core protocols.
Experience with SIEM platforms such as Splunk, as well as EDR and SOAR tools.
Ability to analyze event and system logs; perform host and memory forensics, including live response, on Windows, macOS, and/or Linux; and examine malware.
Experience writing internal playbooks, handbooks, and incident response frameworks.
Knowledge of attack vectors, threat tactics, and attacker techniques.
Knowledge of cloud security concepts and experience with AWS, Azure, or GCP.
Coding or scripting experience in one or more general-purpose languages.
Working knowledge of Canadian regulatory requirements for financial services and public sector clients.
Excellent written and verbal communication skills, including the ability to explain incidents to executives and customers.
Willingness to work weekend and after-hours shifts to respond to priority incidents in a timely manner.
Eligibility to obtain and maintain Government of Canada Reliability Status, including the required screening; candidates generally need Canadian citizenship or permanent resident status.

Nice To Haves

GSEC, GCIH, CEH, GCIA, CISSP, GCFA, or GMON certifications.
ServiceNow platform knowledge.

Responsibilities

Monitor tools and systems defending ServiceNow’s production and regulated environments, and correlate seemingly unrelated events.
Lead response to incidents affecting customers and track incidents to closure across functional teams.
Respond to account-level threats and attacks against customer environments.
Produce post-incident reports, forensic reports, and remediation plans.
Support audits, compliance requirements, and regulatory investigations.
Build and maintain incident response playbooks, handbooks, and cybersecurity standards.
Maintain secure configuration baselines for security tools and other devices, and analyze vulnerabilities using configuration data.
Serve as an escalation point and participate in the on-call rotation, including after-hours and weekends.
Assist with deployment, integration, and initial configuration of new security solutions or enhancements, including network and systems security solutions.