ServiceNow SIR/VR Functional SME (Security Operations)

New River Systems Corporation; Chantilly (VA); Hybrid; USD 150,000 - 245,000; Full time

Job summary

New River Systems Corporation seeks a Security Incident Response (SIR) / Vulnerability Response (VR) Functional SME to establish structured, playbook-driven incident triage and risk-prioritized vulnerability visibility inside DIA’s ServiceNow platform. You will define playbooks, prioritization models, and guide MVP capability from requirements through Walk-phase automation.

The role requires DoD 8570 IAT II or equivalent, ServiceNow CSA certification, and the ability to train SOC analysts during

Qualifications

• Experience in ServiceNow Security Incident Response and/or Vulnerability Response.
• Ability to define incident-type taxonomies, playbooks and severity models.
• Familiarity with ACAS/Tenable vulnerability data and risk-based prioritization.
• Experience with CMDB/ITSM linkage for security operations.
• Comfortable supporting SOC analysts through cutover, training and hypercare.

Responsibilities

• Document current incident-handling and vulnerability-management practice.
• Define the approved incident-type set and playbook catalog.
• Define the ACAS/Tenable feed, ingestion approach and prioritization model.
• Configure Security Incident Response for the approved incident types with standard playbooks.
• Stand up initial SIR dashboards for the SOC and leadership.
• Guide Walk-phase Vulnerability Response MVP: ingestion, risk-based prioritization, automated remediation-task generation.
• Support CMDB/ITSM linkage, analyst training, and operational handoff.

Skills

ServiceNow SIR/VR

Incident taxonomy design

Vulnerability prioritization

ACAS/Tenable familiarity

CMDB/ITSM integration

SOC training/support

Education

High School Diploma/GED

Associates Degree

Bachelor's Degree

Master's Degree

PhD

Job description

New River Systems Corporation seeks a Security Incident Response (SIR) / Vulnerability Response (VR) Functional SME to establish structured, playbook-driven incident triage and risk-prioritized vulnerability visibility inside DIA’s ServiceNow platform. You will define playbooks, prioritization models, and guide MVP capability from requirements through Walk-phase automation.

The role requires DoD 8570 IAT II or equivalent, ServiceNow CSA certification, and the ability to train SOC analysts during