Senior Incident Response Engineer, Security Operations

ServiceNow; United States; Remote; USD 109,000 - 192,000; Full time

Benefits offered by this job

Health plans

ESPP (Employee Stock Purchase Plan)

Matching donations

Flexible time away plan

Family leave programs

Job summary

ServiceNow is seeking a Staff Incident Response Engineer to join the Cyber Investigation, Response & Automation Team in Canada. You will monitor production and regulated environments, lead incidents to closure across teams, and develop robust incident response playbooks while continuously improving security posture.

The role requires experience in security operations, forensics, threat intelligence, and strong collaboration with cross-functional teams.

Qualifications

• Experience integrating AI into work processes, decision-making, or problem-solving.

Responsibilities

• Monitor tools and systems defending production and regulated environments.
• Lead incident response and track incidents to closure across teams.
• Respond to account-level threats against customer environments.
• Produce post-incident and forensic reports, remediation plans.
• Support audits, compliance requirements, and regulatory investigations.
• Build and maintain incident response playbooks and cybersecurity standards.
• Maintain secure baselines for devices and analyze vulnerabilities.
• Serve as escalation point and participate in on-call rotations.
• Assist with deployment and integration of new security solutions.

Skills

AI integration thinking

Security incident response

Threat hunting

Python scripting

Linux/Windows/Mac hardening

Datalogging tools (Splunk)

Vulnerability scanning tools

Communication with executives

Cloud security concepts

Tools

Splunk

Qualys

Nessus

EDR/SOAR tools

AWS/Azure/GCP

Job description

ServiceNow is seeking a Staff Incident Response Engineer to join the Cyber Investigation, Response & Automation Team in Canada. You will monitor production and regulated environments, lead incidents to closure across teams, and develop robust incident response playbooks while continuously improving security posture.

The role requires experience in security operations, forensics, threat intelligence, and strong collaboration with cross-functional teams.