ServiceNow Developer, Sacramento, CA, US

Intellibee; Sacramento (CA); Remote; USD 120,000 - 160,000; Full time

Benefits offered by this job

Long-Term Stability

Comprehensive Health Coverage

401(k) program

Green Card assistance

Job summary

IntelliBee is seeking a ServiceNow IRM/CAM consultant to support deployment and optimization of IRM/CAM modules. The role emphasizes aligning CSF and RMF with risk management workflows and will require collaboration with SMUD's Cybersecurity Risk Team, attending weekly reviews via MS Teams, and developing documentation templates to improve ticket processing and evidence collection.

The contractor will bring years of ServiceNow experience, with emphasis on IRM and CAM, and demonstrate knowledge

Qualifications

• Minimum of four (4) years' experience developing, analyzing, and creating efficiencies within ServiceNow workflow processes.
• Minimum of three (3) years' experience customizing IRM and CAM capabilities within ServiceNow.
• Minimum of three (3) years' experience in a GRC environment with project execution experience.
• Experience collaborating across business units to drive risk assessment process improvements.
• Recent ServiceNow IRM engagement with CAM and ongoing CAM engagement are required.
• Strong understanding of CSF/RMF and applying them within ServiceNow IRM/CAM.

Responsibilities

• Support maturation of ServiceNow IRM/CAM modules and related workflows.
• Review and improve existing ServiceNow workflows and create new ones for risk processes.
• Attend weekly ServiceNow platform enhancement reviews and change management meetings (MS Teams).
• Develop templates and job aids for risk documentation and submissions.
• Assist in RMF pilot leveraging IRM and CAM, including control mapping and artifacts.
• Assess and optimize ServiceNow ticketing and risk assessment workflows for efficiency.

Skills

ServiceNow

IRM

CAM

GRC

CSF/RMF

Cross-functional collaboration

Stakeholder engagement

Education

B.S. Computer Science / MIS / Cybersecurity

Tools

ServiceNow IRM

ServiceNow CAM

MS Teams

Job description

ServiceNow IRM / CAM Consultant, Remote, CA, US

ServiceNow Integrated Risk Management & Continuous Authorization & Monitoring Specialist

SCOPE OF WORK:

SMUD is issuing this Request for Proposal to engage a qualified resource to provide a leased employee to support our continued build out and maturing of ServiceNow's Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) modules. This initiative will help to better align SMUD's Cybersecurity Risk Program with NIST's Cybersecurity and Risk Management Frameworks (CSF/RMF).

client is seeking a leased employee for technical database administrator and developer assistance in maturing our development of ServiceNow's Continuous Authorization and Monitoring (CAM) module. In support of the aforementioned, client is looking for technical expertise to review, consult, improve upon, and continue development of our existing integration to further our progress towards centralizing organizational-level common control, business system and application-level assessment & authorization packages; to include security control attestation and supporting documentation/evidence collection.

To successfully integrate with SMUD's Cybersecurity Risk Team's current approach, it is important that the leased employee have a strong understanding of NIST's Cybersecurity (CSF) and Risk Management Frameworks (RMF), and familiarity with navigating Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53).

Technical assistance is also being sought to support the modification of existing ServiceNow workflows maintained by other SMUD business areas, as well as creation of new workflows to support Cybersecurity Risk Team process efficiencies. This support will require regular attendance at SMUD's weekly ServiceNow platform enhancement reviews, as well as weekly ServiceNow change management review board meetings.

SMUD's Cybersecurity Risk Team welcomes proposals from potential collaborators that outline their technical qualifications, experience assisting clients with ServiceNow CAM module integration work, as well as evidence their understanding of helping clients succeed in their execution and implementation of NIST CSF and RMF. We strongly encourage highlighting any ServiceNow platform specific qualifications that evidence your technical understanding such as ServiceNow's Certified Implementation Specialist – Risk and Compliance, GRC Integrated Risk Management (IRM) Implementer, Certified Technical Architect, Certified Application Developer, etc.

The resource shall provide all labor, and material required to plan and facilitate this leased employee request for a ServiceNow Process Integrated Risk Management/Continuous Authorization and Monitoring (IRM/CAM) Buildout and Cybersecurity Risk Management Queue Optimization to support NIST Risk Management Framework Implementation.

The resource will be responsible for initiating and executing an independent project focused on the assessment of the existing cybersecurity risk assessment process at SMUD; the current methodology of ServiceNow Cybersecurity Risk ticket assignment, ticket types, ticket prioritization, processing times, and assessing the average level of effort (i.e. # of hours, collaboration with stakeholders internal or external to SMUD) required to resolve/close tickets. This assessment will also examine the current assignment workflow within SMUD's existing ServiceNow deployment with a focus on optimization/refinement of the existing processes, as well as helping to establish realistic processing expectancies for stakeholders based on request type.

This effort will also pay careful attention to the information/details being requested to process a ServiceNow ticket, request and propose standardization improvements by helping establish cybersecurity risk documentation templates for SMUD stakeholders to use when initiating ServiceNow ticket requests that will require cybersecurity risk assessments more efficiently.

Review of historical ServiceNow Cybersecurity Risk ticket processing metrics will be necessary to help identify trends that illustrate peak ticket submission timeframes and propose efficiencies that can be implemented to effectively manage the cybersecurity risk ticket queue while considering the inherent resource constraints of having limited personnel to review, investigate, and process ticket submissions. Any proposed considerations will be formally presented to Cybersecurity Department Leadership for review and approval. All cybersecurity risk ticket processing recommendations that receive formal approval will be captured in a documented process methodology that outlines expected processing timelines, defines ticket processing minimum entrance criteria, as well as best practice recommendations for ticket submissions that will better assist the Cybersecurity Risk Team in being able to improve ticket processing timelines.

The leased employee will collaborate directly with SMUD's Cybersecurity Awareness, Training, and Education program in determining the best course of action to raise awareness for SMUD users planning to submit a ticket that will require cybersecurity risk review/assessment.

The leased employee will also be directly responsible for helping execute the initial organizational pilot of the RMF process leveraging the ServiceNow IRM and CAM modules to include assignment and refinement of the security control process (i.e. organization-level owned controls, system-level controls, hybrid controls), security artifact/evidence requirements; development of template/example documentation and job aids for organization stakeholders to leverage; as well as providing recommendations for the execution of continuous monitoring leveraging ServiceNow IRM.

The leased employee will be required to attend SMUD's weekly ServiceNow platform enhancement reviews, as well as weekly ServiceNow change management review board meetings as needed in support of change requests or new items brought forward by SMUD's Cybersecurity Risk Team. Meetings will be supported remotely via MS Teams.

Mandatory Requirements

• Minimum of four (4) years' experience developing, analyzing, and creating efficiencies within ServiceNow workflow processes.
• Minimum of three (3) years' experience customizing Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) capabilities within ServiceNow to align with business objectives and risk appetite of mid to large-sized organizations.
• Minimum of three (3) years' experience working within a governance, risk, and compliance (GRC) environment, with a proven track record of executing corporate projects and growth-based initiatives.
• Minimum of three (3) years' experience working on cross-collaborative efforts, involving establishing partnerships between business units, independently analyzing and engaging organizational stakeholders as needed to ensure smooth process development and implementation across the organization for risk assessment functions.
• Demonstrated experience developing professional templates to support organizational-level, cybersecurity-focused risk assessment processes.
• Proposed resource must have a recent ServiceNow Integrated Risk Management (IRM) engagement with a minimum of three (3) years’ experience and an active ServiceNow Continuous Authorization and Monitoring (CAM) engagement with a minimum of one (1) year continuous operation.
• Must have strong foundational understanding of NIST's Cybersecurity and Risk Management Framework (CSF/RMF), including hands‑on experience aligning CSF and RMF functions within ServiceNow IRM/CAM modules.

Desirable Qualifications

• ServiceNow Practitioner Implementer or above (e.g. Professional Implementer)
• ServiceNow Certified System Administrator (CSA)
• ServiceNow GRC: Integrated Risk Management (IRM) Implementer
• ServiceNow Certified Technical Architect (CTA)
• ISC2 Certified Information Systems Security Professional (CISSP)
• ISC2 Certified – Governance Risk and Compliance (CGRC) or Certified Authorization Professional (CAP)
• ISACA Certified Information Security Manager (CISM)
• ISACA Certified in Risk and Information Systems Control (CRISC)
• CompTIA Certified Advanced Security Practitioner (CASP+)
• CompTIA Security+
• B.S. Computer Science (CS), Management of Information Systems (MIS), or Cybersecurity from an accredited university.

Benefits at IntelliBee

• Long-Term Stability: Join us on a multi-year opportunities with room to grow.
• Comprehensive Health Coverage: Access quality healthcare benefits to keep you and your family well.
• Future Planning: Enroll in our 401(k) program and invest in your financial security.
• GC Assistance: We support immediate Green Card processing, if required.