Lead Incident Response Engineer, 24/7 Security Ops

Servicenow; Canada; On-site; CAD 120,000 - 180,000; Full time

Job summary

ServiceNow is seeking a senior security professional in Canada to lead incident response across production and regulated environments. You will coordinate across teams to detect, respond, and remediate threats, while producing post-incident and forensic reports for audits.

The role requires strong communication to executives, experience with SIEM (Splunk) and vulnerability management, and the ability to integrate AI into security operations. Occasional after-hours work may be required.

Qualifications

• 7 to 10+ years of related experience or equivalent mix of education and experience.
• Experience in Canadian regulated markets (financial services or public sector) desirable.
• Solid understanding of Security Operations Center and incident response protocols.
• Strong ability to explain complex issues to executives and customers.
• Experience with AI integration into work processes is a plus.

Responsibilities

• Monitor tools and systems that defend production and regulated environments.
• Lead response to incidents affecting customers and track to closure across teams.
• Respond to account-level threats and attacks against customer environments.
• Produce post-incident reports, forensic reports, and remediation plans.
• Support audits, compliance requirements, and regulatory investigations.
• Build and maintain incident response playbooks, handbooks, and cybersecurity standards.
• Maintain secure configuration baselines for devices and hosts; analyze vulnerabilities.
• Serve as escalation point and participate in on-call rotation, including after-hours.
• Assist with deployment and integration of new security solutions.

Skills

AI integration

Automation (Python)

Bash scripting

Incident response

Security analytics

Communication to execs

Cloud security concepts

Tools

Splunk

Qualys

Nessus

SOAR tools

Job description

ServiceNow is seeking a senior security professional in Canada to lead incident response across production and regulated environments. You will coordinate across teams to detect, respond, and remediate threats, while producing post-incident and forensic reports for audits.

The role requires strong communication to executives, experience with SIEM (Splunk) and vulnerability management, and the ability to integrate AI into security operations. Occasional after-hours work may be required.