ServiceNow’s Staff Applied Security Engineer role within the ACES team focuses on enabling highly regulated customers to securely adopt the ServiceNow platform, AI capabilities, cloud services, and emerging technologies. The position combines customer-facing architecture work with hands-on security engineering, including threat modeling, security deep dives, and development of security reference architectures.
Key Responsibilities
- Partner directly with customer security, architecture, engineering, risk, compliance, and executive stakeholders to address security concerns and accelerate platform adoption.
- Develop customer-facing security reference architectures that describe trust boundaries, data flows, identity models, encryption controls, and shared responsibility models.
- Conduct threat modeling for ServiceNow products, AI services, integrations, and customer deployment architectures.
- Analyze security architectures across cloud-native and distributed systems environments.
- Lead security deep dives across networking, identity, encryption, data protection, application security, and AI security controls.
- Evaluate customer security requirements and map them to ServiceNow platform capabilities and industry best practices.
- Collaborate with Product Management, Engineering, Product Security, and Architecture teams to identify capability gaps and advocate for customer-driven improvements.
- Create scalable security artifacts such as architecture patterns, deployment guides, implementation accelerators, technical whitepapers, detection content, and security design documentation.
- Assess integrations involving AI, cloud services, APIs, Kubernetes environments, data platforms, and third-party technologies.
- Help define secure deployment patterns for emerging AI capabilities, including agents, model integrations, governance controls, and data protection mechanisms.
- Represent ServiceNow security architecture and best practices during customer workshops, architecture reviews, executive briefings, and security assessments.
Required Qualifications
- 5+ years of hands-on experience in security engineering, security architecture, cloud security, application security, product security, or related disciplines.
- Strong understanding of core security principles, including identity and access management; authentication and authorization; network security; cryptography and key management; data protection and privacy; security monitoring and incident response; and secure software development.
- Experience assessing and securing cloud-native architectures.
- Strong knowledge of Kubernetes, container security, service-to-service communications, workload isolation, and modern application deployment patterns.
- Experience with one or more major cloud providers: AWS, Microsoft Azure, or Google Cloud Platform (GCP).
- Experience conducting threat modeling using frameworks such as STRIDE, ATT&CK, PASTA, or similar methodologies.
- Ability to build and communicate architecture diagrams that clearly articulate data flows, trust boundaries, security controls, and deployment models.
- Strong written and verbal communication skills, with the ability to engage audiences ranging from engineers to CISOs.
- Experience presenting security recommendations and architectural guidance to customers and executive stakeholders.
- A curious mindset with willingness to continuously learn emerging technologies, including AI, cloud-native platforms, and modern security architectures.
Technologies
- Kubernetes
- Amazon Web Services (AWS)
- Microsoft Azure
- Google Cloud Platform (GCP)
- STRIDE
- ATT&CK
- PASTA
- JavaScript
Preferred Qualifications
- Experience supporting Fortune 500 or highly regulated enterprise customers.
- Experience working with financial services, healthcare, or public sector organizations.
- Knowledge of AI security, AI governance, model risk management, prompt injection risks, agentic systems, and emerging AI threats.
- Experience using AI technologies to improve security operations, threat detection, security analysis, or engineering productivity.
- Familiarity with JavaScript, scripting, or automation development.
- Experience with the ServiceNow platform.
- Experience developing security reference architectures, implementation patterns, or technical guidance consumed at scale.
- Industry certifications such as CISSP, CCSP, AWS Security Specialty, Azure Security Engineer, GSEC, GIAC, OSCP, or equivalent.
Location and Work Persona
Location: Santa Clara, CA (onsite). ServiceNow uses work personas that may be flexible, remote, or require in-office presence depending on the nature of the work and assigned work location. To determine eligibility for a work persona, ServiceNow may confirm the distance between the primary residence and the closest ServiceNow office using a third-party service.
Application Accommodations
If you require a reasonable accommodation to complete any part of the application process, or cannot use the online application and need an alternative method to apply, contact globaltalentss@servicenow.com.
Export Control Regulations
For positions requiring access to controlled technology subject to export control regulations, including the U.S. Export Administration Regulations (EAR), ServiceNow may be required to obtain export control approval from government authorities for certain individuals. All employment is contingent upon ServiceNow obtaining any export license or other approval that may be required by relevant export control authorities.
