Senior PSIRT Lead: Product Security & Incident Response

ServiceNow; California; On-site; USD 201,000 - 352,000; Full time

Benefits offered by this job

Health plans

401(k) with company match

ESPP

Flexible time away

Family leave programs

Job summary

ServiceNow is seeking a senior staff-level product security engineer to lead PSIRT activities for post-release vulnerabilities across our platform. You will operate as a technical authority, drive deep-dive investigations, coordinate across engineering, product, and release teams, and lead incident response under pressure.

You will shape our vulnerability response strategy, own CVE disclosures, author postmortems, and push secure development practices across the SDLC.

Qualifications

• Experience integrating AI into work processes and decision-making.
• 12+ years with a Bachelor's degree; or 8 years with a Master's; or PhD with 5 years of experience.
• Minimum 5 years auditing source code for security vulnerabilities.
• Ability to read and comprehend Java and JavaScript code.
• Experience leading CVE disclosures and coordinating across teams.

Responsibilities

• Demonstrate leadership during security events and incidents under pressure.
• Coordinate with incident commanders, security leadership, engineering, and release teams to maintain ownership and hand-offs during events.
• Drive coordinated response across affected releases and move fixes through the pipeline without stalling on boundaries.
• Lead CVE disclosure process—CVE assignment, scoring, advisory content, and publication timing.
• Author postmortems and drive lessons learned to closure following significant incidents.

Skills

AI in Work

Security Incident Response

Leadership

Java

JavaScript

Python Scripting

CVE Disclosure

Education

Bachelor's degree or higher

Tools

AWS

Docker

Kubernetes

CI/CD Tools

Job description

ServiceNow is seeking a senior staff-level product security engineer to lead PSIRT activities for post-release vulnerabilities across our platform. You will operate as a technical authority, drive deep-dive investigations, coordinate across engineering, product, and release teams, and lead incident response under pressure.

You will shape our vulnerability response strategy, own CVE disclosures, author postmortems, and push secure development practices across the SDLC.