ServiceNow Developer

ExecRecruitment; United States; On-site; USD 165,000 - 248,000; Full time

Job summary

SMUD is seeking a leased employee to support the ongoing buildout and maturation of the ServiceNow CAM and IRM modules, aligning the Cybersecurity Risk Program with NIST CSF/RMF. The resource will review, consult, and enhance existing ServiceNow workflows and integrations to centralize risk assessments and attestation evidence across applications and systems.

The role requires participation in weekly ServiceNow platform enhancement reviews and change management meetings, with a focus on

Job description

SCOPE OF WORK:

SMUD is issuing this Request for Proposal to engage a qualified resource to provide a leased employee to support our continued build out and maturing of ServiceNow's Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) modules. This initiative will help to better align SMUD's Cybersecurity Risk Program with NIST's Cybersecurity and Risk Management Frameworks (CSF/RMF). client is seeking a leased employee for technical database administrator and developer assistance in maturing our development of ServiceNow's Continuous Authorization and Monitoring (CAM) module. In support of the aforementioned, client is looking for technical expertise to review, consult, improve upon, and continue development of our existing integration to further our progress towards centralizing organizational-level common control, business system and application-level assessment & authorization packages; to include security control attestation and supporting documentation/evidence collection. To successfully integrate with SMUD's Cybersecurity Risk Team's current approach, it is important that the leased employee have a strong understanding of NIST's Cybersecurity (CSF) and Risk Management Frameworks (RMF), and familiarity with navigating Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53). Technical assistance is also being sought to support the modification of existing ServiceNow workflows maintained by other SMUD business areas, as well as creation of new workflows to support Cybersecurity Risk Team process efficiencies. This support will require regular attendance at SMUD's weekly ServiceNow platform enhancement reviews, as well as weekly ServiceNow change management review board meetings. SMUD's Cybersecurity Risk Team welcomes proposals from potential collaborators that outline their technical qualifications, experience assisting clients with ServiceNow CAM module integration work, as well as evidence their understanding of helping clients succeed in their execution and implementation of NIST CSF and RMF. We strongly encourage highlighting any ServiceNow platform specific qualifications that evidence your technical understanding such as ServiceNow's Certified Implementation Specialist - Risk and Compliance, GRC Integrated Risk Management (IRM) Implementer, Certified Technical Architect, Certified Application Developer, etc. The resource shall provide all labor, and material required to plan and facilitate this leased employee request for a ServiceNow Process Integrated Risk Management/Continuous Authorization and Monitoring (IRM/CAM) Buildout and Cybersecurity Risk Management Queue Optimization to support NIST Risk Management Framework Implementation. The resource will be responsible for initiating and executing an independent project focused on the assessment of the existing cybersecurity risk assessment process at SMUD; the current methodology of ServiceNow Cybersecurity Risk ticket assignment, ticket types, ticket prioritization, processing times, and assessing the average level of effort (i.e. # of hours, collaboration with stakeholders internal or external to SMUD) required to resolve/close tickets. This assessment will also examine the current assignment workflow within SMUD's existing ServiceNow deployment with a focus on optimization/refinement of the existing processes, as well as helping to establish realistic processing expectancies for stakeholders based on request type. This effort will also pay careful attention to the information/details being requested to process a ServiceNow ticket, request and propose standardization improvements by helping establish cybersecurity risk documentation templates for SMUD stakeholders to use when initiating ServiceNow ticket requests that will require cybersecurity risk assessments more efficiently. Review of historical ServiceNow Cybersecurity Risk ticket processing metrics will be necessary to help identify trends that illustrate peak ticket submission timeframes and propose efficiencies that can be implemented to effectively manage the cybersecurity risk ticket queue while considering the inherent resource constraints of having limited personnel to review, investigate, and process ticket submissions. Any proposed considerations will be formally presented to Cybersecurity Department Leadership for review and approval. All cybersecurity risk ticket processing recommendations that receive formal approval will be captured in a documented process methodology that outlines expected processing timelines, defines ticket processing minimum entrance criteria, as well as best practice recommendations for ticket submissions that will better assist the Cybersecurity Risk Team in being able to improve ticket processing timelines. The leased employee will collaborate directly with SMUD's Cybersecurity Awareness, Training, and Education program in determining the best course of action to raise awareness for SMU