Global Security Incident Commander Lead Critical Response

SmartRecruiters, Inc.; Santa Clara (CA); Hybrid; USD 146,000 - 256,000; Full time

Benefits offered by this job

Health plans

401(k) Plan with company match

ESPP

Matching donations

Flexible time away plan

Family leave programs

Equity where applicable

Job summary

ServiceNow is seeking an experienced Senior Security Incident Commander to join the Security Organization (SSO). The role leads incident response strategy, communications, and remediation for high-priority security events, coordinating with regional teams and executives.

You will develop playbooks, run tabletop exercises, and deliver clear briefings to senior leadership while advancing MSI preparedness and post-incident reviews.

Qualifications

• 8+ years of total cybersecurity experience or equivalent education.
• 4-6+ years of deep domain expertise in incident response and/or incident management.
• Experience leading or supporting complex security incidents to resolution end-to-end.
• Excellent verbal and written communication skills (English).
• Comfort communicating complex topics to varied audiences (technical, execs).
• Problem-solving and decision-making skills.
• Familiarity with cybersecurity principles and frameworks (e.g. MITRE ATT&CK).
• Experience planning and/or orchestrating tabletop exercises is a plus.

Responsibilities

• Orchestration of response and remediation of incident response for highest criticality security events.
• Take ownership and lead response to critical incidents within the company.
• Establish and mature documentation surrounding protocols and procedures governing the security incident command team.
• Prepare and deliver communications, including executive summaries and incident briefings, to key stakeholders during and after incident response.
• Conduct rapid response, mitigation, and investigations on the highest priority cases impacting ServiceNow and user data.
• Partner with the team across regions to drive response and investigations globally.
• Organize scenario-based exercises to test and improve incident management and response strategies.
• Maintain and develop playbooks to standardize SIC and partner responses.

Skills

Incident response

Crisis management

Executive communications

Cross-team coordination

AI in security

Risk assessment

Tools

MITRE ATT&CK

Job description

ServiceNow is seeking an experienced Senior Security Incident Commander to join the Security Organization (SSO). The role leads incident response strategy, communications, and remediation for high-priority security events, coordinating with regional teams and executives.

You will develop playbooks, run tabletop exercises, and deliver clear briefings to senior leadership while advancing MSI preparedness and post-incident reviews.