Remote Senior Security Incident Commander

Visalytics; Santa Clara (CA); On-site; USD 146,000 - 256,000; Full time

Benefits offered by this job

Health plans

401(k) Plan with company match

ESP P

Job summary

ServiceNow is seeking a senior Security Incident Commander to join our Security Incident Command (SIC) team. You will orchestrate incident response strategy and communications during high‑severity information security incidents, partnering with regional teams to coordinate global investigations.

In this role you will own MSI lifecycle activities, develop playbooks, deliver executive briefings, and drive post‑incident reviews to improve readiness.

Qualifications

• 8+ years of total cybersecurity experience.
• 4–6+ years in incident response/management.
• Experience leading complex security incidents end‑to‑end.
• Excellent verbal and written English.
• Familiarity with MITRE ATT&CK.
• Ability to communicate to executives clearly.
• Experience integrating AI into security workflows is a plus.

Responsibilities

• Orchestrate response and remediation of high‑priority security events.
• Take ownership and lead responses to critical incidents.
• Document and mature incident response protocols and playbooks.
• Prepare executive summaries and incident briefings for stakeholders.
• Conduct rapid investigations and coordinate global efforts.
• Partner across regions to drive global response and investigations.
• Facilitate scenario‑based exercises to test response strategies.
• Contribute to post‑incident reviews and root cause analyses.
• Identify ways to simplify and automate major incident processes.

Skills

Incident response

Incident management

Executive communication

English proficiency

MITRE ATT&CK

AI in security

Cross-domain knowledge

Tabletop exercises

Job description

ServiceNow is seeking a senior Security Incident Commander to join our Security Incident Command (SIC) team. You will orchestrate incident response strategy and communications during high‑severity information security incidents, partnering with regional teams to coordinate global investigations.

In this role you will own MSI lifecycle activities, develop playbooks, deliver executive briefings, and drive post‑incident reviews to improve readiness.