ServiceNow Security Engineer

Support ServiceNow platform security through governance, authorization, continuous monitoring, and vulnerability management.

Responsibilities

• Perform governance, compliance, and assurance activities to ensure ServiceNow aligns with NIST SP 800-53, NIST RMF, and FedRAMP across environments and instances.
• Define, document, and assess security requirements for ServiceNow implementations, including control selection, tailoring, and technical implementation across instance configurations and workflows.
• Build, configure, and enforce security controls such as ACLs, RBAC, Column-Level Encryption, encryption in transit, and IP address restrictions following the ServiceNow Hardening Guide.
• Configure and monitor ServiceNow event and security telemetry and maintain SIEM integrations for continuous monitoring, alert correlation, and incident detection.
• Support continuous monitoring for the ServiceNow boundary with automated evidence gathering, control validation, and recurring assessment activities.
• Manage the POA&M lifecycle: document findings, assign technical owners, track milestones, validate remediation testing, and close security items.
• Develop and maintain ATO packages for the ServiceNow ecosystem, including SSPs, technical boundary diagrams, control implementation summaries, and evidence artifacts.
• Support internal and external security assessments by coordinating with SCAs, federal auditors, and 3PAOs during formal evaluations.
• Partner with system owners, ISSOs, ServiceNow platform administrators, developers, and solution architects to implement controls and remediate audit findings.
• Perform vulnerability management across the ServiceNow platform and integrations by reviewing patch levels, evaluating CVEs, prioritizing remediation, and tracking resolution timelines.
• Validate and enforce secure configuration baselines using ServiceNow Instance Security Center (ISC) and security benchmarks such as CIS benchmarks and DISA STIGs.
• Assist with security incident response for the ServiceNow environment, supporting triage, root-cause investigation, containment, and formal reporting.
• Conduct log analysis using ServiceNow transaction logs, system logs, and administrative audit trails to detect anomalous activity and support federal logging mandates (e.g., OMB M-21-31).
• Oversee user access controls, privileged access management, and SSO/MFA configurations, including periodic user access recertifications.
• Maintain configuration integrity and asset visibility within the CMDB aligned to RMF inventory and categorization standards.
• Develop and maintain technical security architecture documentation, SOPs, and operational playbooks for platform security administration.
• Formulate and execute project plans for deploying, upgrading, and maintaining ServiceNow security capabilities, modules, and platform updates.
• Perform risk assessments and security impact evaluations for change requests, including plugin installations, update sets, custom integrations, and security policy exceptions.
• Support secure development practices for custom ServiceNow applications and catalog items by conducting security reviews of Script Includes, Business Rules, client scripts, and automated test pipelines.
• Use threat intelligence feeds to refine security workflows, identify emerging platform threats, and enhance incident containment playbooks.
• Track, aggregate, and report security posture metrics such as instance hardening scores, vulnerability remediation timelines, POA&M aging, and audit compliance rates using ServiceNow dashboards and reporting tools.

Requirements

• Ability to obtain Department of Homeland Security (DHS) Entry On Duty (EOD).
• B.A./B.S. or equivalent plus 15 years of relevant experience.
• Experience supporting ServiceNow development.
• Understanding of NIST SP 800-53, RMF, FedRAMP, and federal security control frameworks.
• Hands-on experience supporting ATO packages, SSP development, control implementation statements, and evidence collection.
• Experience performing security assessments, vulnerability analysis, risk assessments, and remediation tracking.

Technologies

• ServiceNow
• NIST SP 800-53
• NIST RMF
• FedRAMP
• SIEM
• ServiceNow Hardening Guide
• Access Control Lists (ACLs)
• Role-Based Access Control (RBAC)
• Column-Level Encryption
• Encryption in transit
• ServiceNow Instance Security Center (ISC)
• CIS benchmarks
• DISA STIGs
• Plan of Action and Milestones (POA&M)
• Authorization to Operate (ATO)
• System Security Plans (SSPs)
• Security Control Assessors (SCAs)
• Third-Party Assessment Organizations (3PAOs)
• SSO/MFA
• ServiceNow Configuration Management Database (CMDB)
• OMB M-21-31

Benefits

• Healthcare
• Wellness
• Financial
• Retirement
• Family support
• Continuing education
• Time off benefits
• Flexible time off
• Robust learning resources

Desired

• CISSP, CCSP, CEH, CySA+, or AWS/Azure security certifications (highly desired)

Pay Range

• USD 105,100 - 231,100 per year

• Location: Remote
• Time type: Full time
• Employee type: Regular
• Travel: None
• Minimum clearance required to start: None