Senior PSIRT Lead – Product Security and Incident Response

ServiceNow; Washington; On-site; USD 201,000 - 352,000; Full time

Job summary

ServiceNow is seeking a senior staff-level Product Security Engineer within the Security Organization (SSO) to lead post-release vulnerability responses and oversee PSIRT activities. You will drive investigations, coordinate across engineering, product, and release teams, and shape incident response at scale.

Ideal candidates bring deep expertise in Java, JavaScript, Python, and secure software development, with on-call readiness and strong communication to technical and leadership audiences.

Qualifications

• Minimum 12 years of related experience with a Bachelor’s; or 8 years with a Master; or 5 years with a PhD.
• Minimum 5 years of auditing source code for security vulnerabilities.
• Experience leading fixes and release coordination across teams.
• Proven leadership during significant security events and on‑call readiness.

Responsibilities

• Lead deep-dive investigations and coordinate resolutions across engineering, product, and release teams.
• Own CVE disclosure process including CVE assignment and advisory publication.
• Author postmortems and drive lessons learned to closure after incidents.
• Guide SDLC improvements and secure development practices across portfolios.

Skills

Java

JavaScript

Python

Incident response

Security leadership

Code auditing

CI/CD

Threat modelling

Education

Bachelor’s degree (or higher) in a related field

Master’s degree (preferred)

PhD (related) with 5+ years experience

Tools

None specified

Job description

ServiceNow is seeking a senior staff-level Product Security Engineer within the Security Organization (SSO) to lead post-release vulnerability responses and oversee PSIRT activities. You will drive investigations, coordinate across engineering, product, and release teams, and shape incident response at scale.

Ideal candidates bring deep expertise in Java, JavaScript, Python, and secure software development, with on-call readiness and strong communication to technical and leadership audiences.