ServiceNow Security Engineer

Cybersecurity Jobs

United States

Remote

USD 105,000 - 231,000

Full time

3 days ago

Be an early applicant

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Benefits offered by this job

Healthcare

Wellness

Retirement plan

Education resources

Time off

Job summary

Cybersecurity Jobs seeks a seasoned ServiceNow security professional to govern, assess, and implement security controls aligned with NIST SP 800-53, RMF, and FedRAMP across all ServiceNow environments.

You will lead governance activities, define security requirements, enforce controls, and support continuous monitoring with SIEM integrations. The role includes developing ATO packages, SSPs, evidence artifacts, and coordinating with federal auditors and 3PAOs.

Qualifications

Bachelor's or higher degree with 15+ years of relevant experience.
Experience supporting ServiceNow development and platform security.
Hands-on with security controls, ATO packages, SSPs, and evidence collection.
Familiarity with NIST SP 800-53, RMF, FedRAMP, and federal security controls.

Responsibilities

Governance, compliance, and assurance activities for ServiceNow per NIST SP 800-53, RMF, and FedRAMP.
Define and assess security requirements for ServiceNow implementations across configurations.
Build and enforce controls (ACLs, RBAC, encryption, IP restrictions) per ServiceNow Hardening Guide.
Configure SIEM integrations and continuous monitoring; manage POA&M lifecycle and evidence artifacts.
Develop and maintain ATO packages, SSPs, and control implementation statements.
Coordinate with SCAs, auditors, and 3PAOs during formal evaluations.
Oversee access controls, SSO/MFA, and CMDB alignment with RMF.

Skills

Security governance

Regulatory compliance

Vulnerability management

ServiceNow development support

Education

BA/BS or equivalent, 15+ years

Tools

ServiceNow

SIEM

ServiceNow ISC

Job description

Support ServiceNow platform security through governance, authorization, continuous monitoring, and vulnerability management.

Responsibilities

Perform governance, compliance, and assurance activities to ensure ServiceNow aligns with NIST SP 800-53, NIST RMF, and FedRAMP across environments and instances.
Define, document, and assess security requirements for ServiceNow implementations, including control selection, tailoring, and technical implementation across instance configurations and workflows.
Build, configure, and enforce security controls such as ACLs, RBAC, Column-Level Encryption, encryption in transit, and IP address restrictions following the ServiceNow Hardening Guide.
Configure and monitor ServiceNow event and security telemetry and maintain SIEM integrations for continuous monitoring, alert correlation, and incident detection.
Support continuous monitoring for the ServiceNow boundary with automated evidence gathering, control validation, and recurring assessment activities.
Manage the POA&M lifecycle: document findings, assign technical owners, track milestones, validate remediation testing, and close security items.
Develop and maintain ATO packages for the ServiceNow ecosystem, including SSPs, technical boundary diagrams, control implementation summaries, and evidence artifacts.
Support internal and external security assessments by coordinating with SCAs, federal auditors, and 3PAOs during formal evaluations.
Partner with system owners, ISSOs, ServiceNow platform administrators, developers, and solution architects to implement controls and remediate audit findings.
Perform vulnerability management across the ServiceNow platform and integrations by reviewing patch levels, evaluating CVEs, prioritizing remediation, and tracking resolution timelines.
Validate and enforce secure configuration baselines using ServiceNow Instance Security Center (ISC) and security benchmarks such as CIS benchmarks and DISA STIGs.
Assist with security incident response for the ServiceNow environment, supporting triage, root‑cause investigation, containment, and formal reporting.
Conduct log analysis using ServiceNow transaction logs, system logs, and administrative audit trails to detect anomalous activity and support federal logging mandates (e.g., OMB M-21-31).
Oversee user access controls, privileged access management, and SSO/MFA configurations, including periodic user access recertifications.
Maintain configuration integrity and asset visibility within the CMDB aligned to RMF inventory and categorization standards.
Develop and maintain technical security architecture documentation, SOPs, and operational playbooks for platform security administration.
Formulate and execute project plans for deploying, upgrading, and maintaining ServiceNow security capabilities, modules, and platform updates.
Perform risk assessments and security impact evaluations for change requests, including plugin installations, update sets, custom integrations, and security policy exceptions.
Support secure development practices for custom ServiceNow applications and catalog items by conducting security reviews of Script Includes, Business Rules, client scripts, and automated test pipelines.
Use threat intelligence feeds to refine security workflows, identify emerging platform threats, and enhance incident containment playbooks.
Track, aggregate, and report security posture metrics such as instance hardening scores, vulnerability remediation timelines, POA&M aging, and audit compliance rates using ServiceNow dashboards and reporting tools.

Requirements

Ability to obtain Department of Homeland Security (DHS) Entry On Duty (EOD).
B.A./B.S. or equivalent plus 15 years of relevant experience.
Experience supporting ServiceNow development.
Understanding of NIST SP 800-53, RMF, FedRAMP, and federal security control frameworks.
Hands‑on experience supporting ATO packages, SSP development, control implementation statements, and evidence collection.
Experience performing security assessments, vulnerability analysis, risk assessments, and remediation tracking.