Senior Product Security PSIRT Engineer — Remote Lead

VulnU; United States; Remote; USD 201,000 - 352,000; Full time

Benefits offered by this job

Paid parental leave

Retirement match

Equity

Learning budget

Job summary

ServiceNow is seeking a senior staff-level product security engineer to serve as the senior technical authority within the Product Security Incident Response Team (PSIRT). You will lead deep-dive investigations, coordinate resolution across engineering, product, and release teams, and demonstrate calm, decisive leadership during significant security events.

This role requires extensive experience in product security, incident response, CVE disclosure, and secure development practices, with

Qualifications

• Minimum 5 years of auditing source code for security vulnerabilities.
• Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
• Ability to read and comprehend Java and JavaScript code.
• Proficiency in Python and JavaScript scripting for data gathering and visualization.
• Experience with leading CVE disclosure processes and coordinating external advisories.

Responsibilities

• Lead PSIRT investigations and coordinate responses during security incidents.
• Partner with incident commanders, information security leadership, engineering, and product teams during events.
• Drive CVE disclosure process and advisory publication timing.
• Conduct postmortems and drive lessons learned to closure after incidents.
• Contribute to SDLC improvements by feeding incident learnings back into secure development practices.

Skills

Java

JavaScript

Python

Exploit development

Incident investigations

Release coordination

CI/CD

Threat modeling

CVE disclosure

Education

Bachelor's degree

Master's degree

PhD

Tools

CVSS

Job description

ServiceNow is seeking a senior staff-level product security engineer to serve as the senior technical authority within the Product Security Incident Response Team (PSIRT). You will lead deep-dive investigations, coordinate resolution across engineering, product, and release teams, and demonstrate calm, decisive leadership during significant security events.

This role requires extensive experience in product security, incident response, CVE disclosure, and secure development practices, with