Staff Incident Response Engineer

ServiceNow

1d•$109,400 - $191,500

About The Position

This Staff Incident Response Engineer role is part of ServiceNow’s Cyber Investigation, Response & Automation Team and supports commercial and regulated-market customer environments in Canada. The role monitors and improves the tools and systems that defend ServiceNow’s production and regulated environments, correlates events, and helps the team respond effectively while maintaining a strong focus on quality. The ServiceNow Security Organization develops security solutions to reduce risk, protect the company and its customers, and enable secure migration of sensitive data and workloads to the cloud. The position leads and supports incident response, threat investigations, digital forensics, threat hunting, and security operations. It works across functional teams to resolve incidents, communicate findings, create remediation plans, maintain security standards and playbooks, and improve security tooling and configurations. The role may participate in a rotational schedule providing 24x7 operational support, including non-standard hours, weekends, and statutory holidays. Employment requires successful completion and maintenance of a Government of Canada Reliability Status screening, including five years of verifiable background history, identity and education verification, criminal record and credit checks. Candidates must be eligible to obtain and maintain Reliability Status, which generally requires Canadian citizenship or permanent resident status. The role may require security clearance in the future. The stated base pay range is $109,400–$191,500, plus equity when applicable, variable/incentive compensation, and benefits. The company also offers health plans, flexible spending accounts, an employee stock purchase plan, matching donations, a flexible time away plan, and family leave programs. Work personas may be flexible, remote, or required in office, depending on the nature of the work and assigned location; the specific persona for this position is not stated.

Requirements

At least 6 years of related experience or an equivalent combination of education and experience; the requirements section also specifies 7 to 10+ years of related experience or an equivalent mix of education and experience.
Experience in Canadian regulated markets, such as financial services or the public sector, is highly desirable.
Deep understanding of Security Operations Center operations and security incident response protocols and procedures.
Extensive experience in incident response, digital forensics, threat hunting, and threat intelligence.
Solid networking foundation, including TCP/IP and core protocols.
Experience with SIEM platforms such as Splunk, as well as EDR and SOAR tools.
Ability to analyze event and system logs, perform host and memory forensics (including live response) on Windows, macOS, and/or Linux, and examine malware.
Experience writing internal playbooks, handbooks, and incident response frameworks.
Knowledge of attack vectors, threat tactics, and attacker techniques.
Knowledge of cloud security concepts and experience with AWS, Azure, or GCP.
Coding or scripting experience in one or more general-purpose languages; automation knowledge such as Python or bash scripting is also specified.
Experience hardening Linux, Windows, or Mac systems.
Background working with data logging applications such as Splunk.
Knowledge of vulnerability scanning tools such as Qualys or Nessus.
Working knowledge of Canadian regulatory requirements for financial services and public sector clients.
Experience leveraging or critically thinking about integrating AI into work processes, decision-making, or problem-solving, including AI-powered tools, workflow automation, or AI-driven insights.
Excellent written and verbal communication skills, including the ability to explain incidents and complex issues to executives and customers.
Defensive security mindset.
Willingness to work weekend and after-hours shifts to respond to priority incidents in a timely manner.
Must successfully complete and maintain Government of Canada Reliability Status screening; the process includes five years of verifiable background history, identity and education verification, a criminal record check, and a credit check.
Must be eligible to obtain and maintain Reliability Status, which generally requires Canadian citizenship or Canadian permanent resident status.

Nice To Haves

GSEC, GCIH, CEH, GCIA, CISSP, GCFA, or GMON certification.
ServiceNow platform knowledge.

Responsibilities

Monitor the tools and systems that defend ServiceNow’s production and regulated environments, and correlate seemingly unrelated events.
Lead response to incidents affecting customers and track incidents to closure across functional teams.
Respond to account-level threats and attacks against customer environments.
Produce post-incident reports, forensic reports, and remediation plans.
Support audits, compliance requirements, and regulatory investigations.
Build and maintain incident response playbooks, handbooks, and cybersecurity standards.
Maintain secure configuration baselines for devices under direct control, such as security tools, and devices not under direct control, such as workstations, servers, and network devices; analyze vulnerabilities using this data.
Serve as an escalation point and participate in the on-call rotation, including after-hours and weekend coverage.
Assist with deployment, integration, and initial configuration of new security solutions or enhancements to existing solutions, including network and systems solutions, to improve security posture.