ServiceNow

ServiceNow Cybersecurity Jobs

31 jobs found

Today

Cybersecurity Compliance Systems Administrator

Akima, LLC Honolulu, HI

Honolulu, HI

Today

$122k - $136k/yr Full time Cyber Security Cybersecurity Operations Cybersecurity Tools

Apply Now

Job Description

Akima, LLC is seeking a Systems Administrator (Compliance) to support the computer network defense (CND) program from Honolulu, HI. This onsite role focuses on administering Nessus Security Manager (ACAS) and maintaining STIG and DoD PKI compliance through continuous assessments, monitoring, and audit readiness.

Key Responsibilities

Administer and manage Nessus Security Manager, including associated scanners and Network Monitor; configure, maintain, and troubleshoot components as needed.
Analyze system deficiencies, propose engineering solutions, and resolve complex technical issues affecting compliance and operational continuity.
Monitor cybersecurity alerts and task orders, ensuring timely communication and prompt action related to compliance requirements.
Perform continuous assessment activities to evaluate cybersecurity posture using tools including ACAS, CMRS, ESS, C2C, and Splunk SIEM, coordinating with other cybersecurity professionals to support effective compliance strategies.
Support audit preparation efforts, stay current on cybersecurity trends, and help develop training programs covering compliance and Nessus usage.
Maintain STIG compliance by reviewing service tickets, creating Certified Network Defender (CND) workflows in ServiceNow, and ensuring systems meet DoD PKI requirements.
Provide regular reporting on accomplishments, issues, and improvement recommendations.

Required Qualifications

Active TS/SCI clearance.
Ability to meet DoDM 8410.03 requirements, with intermediate proficiency level.
Possess one of the following 8570 IAM-II certifications: CAP (Certified Authorization Professional), CASP+ CE, CISM (Certified Information Security Manager), CISSP (or Associate), GSLC (GIAC Security Leadership Certification), CCISO (Certified Chief Information Security Officer), or HCISPP (Healthcare Information Security and Privacy Practitioner).
One or more relevant Certified Network Defender (CND) certifications: CISSP, CASP, OSCP, CySA+, CEH, or GCIH.
Assured Compliance Assessment Solution (ACAS) Administrator certification required within the first 60 days of employment.
Minimum High School Diploma/GED.
At least four years of Core Skills for Work Developmental Framework (CSFW) system or network administration experience.
Expert-level knowledge of Windows operating systems and working knowledge of Linux operating systems.
Experience identifying and applying applicable security requirements including STIGs, IAVAs, and CTOs to DoD systems.
Demonstrated strong analytical and problem-solving skills, with excellent communication and collaboration abilities.
May require after-hours and weekend support to manage service outages.

Technologies

Nessus Security Manager (ACAS), Network Monitor
ACAS, CMRS, ESS, C2C, Splunk SIEM
ServiceNow
DoD PKI, STIGs, IAVAs, CTOs
Windows operating systems, Linux operating systems

Salary and Location

Location: Honolulu, HI (onsite)

Salary: USD 122,000 - 136,000 per year

Benefits

Medical, Dental, Vision
Life insurance
401(k)
PTO (Paid Time Off) for regular full-time and part-time employees
Other voluntary benefits
Comprehensive benefits program
Competitive pay
Excellent retirement options

Desired Qualifications

Splunk or other SIEM experience preferred.
Preference for at least one year of experience administering Nessus Security Manager (ACAS).

Additional Information

This position is contingent upon contract award and funding. Applicants selected may be offered but cannot begin work until funding has been confirmed.

View full job page →

2d ago

Application Security Program Manager

Knowledge Services United States 🇺🇸 Remote

United States

2d ago

Contract Manager Application Security Application Security Program

Apply Now

Job Description

Knowledge Services is hiring a remote Application Security Program Manager (contract) to help the State of Maine transition and sustain application security practices within the SSDLC.

Responsibilities

Support the Information Security Office in transitioning the State’s secure software development lifecycle (SSDLC) from near-complete modernization to a sustained operating program.
Coordinate the people, decisions, workflows, and measures needed to make application security practices workable across State technology teams.
Shift from transition activities to adoption, performance, risk reduction, and continuous improvement across the application security portfolio.
Lead a cross-functional program management effort across application security stakeholders.
Partner with Vulnerability Management, Security Architecture, Governance Risk and Compliance (GRC), Application Development, GitHub Governance, infrastructure and platform teams, agency product owners, and vendors.
Drive follow-through, adoption, and accountability across stakeholders, escalating decisions to the appropriate owner while specialist teams retain authority for technical, product, and risk approvals.
Oversee application security efforts across multiple teams to improve the State of Maine’s security posture.
Coordinate handoff from project deliverables to owned processes, including named owners, documented handoffs, decision paths, service expectations, and an operating cadence.
Maintain a program roadmap covering priorities, dependencies, risks, and an improvement backlog.
Validate and improve the application risk profile and security workflows, including design review, scanning, finding triage, remediation, exceptions, and release workflows.
Ensure guidance aligns with real tools, different applications, and vendor models.
Plan rollout waves with development and platform partners; support security champions, training, office hours, and developer-facing guidance.
Collect feedback and remove barriers that prevent teams from consistently applying the workflow.
Help product and development teams convert findings into risk-ranked plans with owners, target dates, and closure evidence.
Track coverage gaps, aging findings, blockers, and escalations while responsible teams remediate and verify results.
Facilitate working groups and leadership reviews; maintain a responsibility model; route design questions through Security Architecture and policy, exception, and risk decisions through GRC and authorized Information Security Office leadership.
Define measures with data owners and coordinate trustworthy reporting on application coverage, adoption, remediation, exceptions, and control performance; use trends and stakeholder feedback to propose changes and adjust priorities.
Coordinate related initiatives across repository governance, security tooling, platform integration, third-party application security, and developer enablement.
Surface capacity, funding, and service dependencies; prepare concise options and recommendations for leadership.

Requirements

8 to 10 years of experience in leadership roles and cybersecurity program management, including change agent work improving application security program maturity.
Experience improving application security program maturity.
Stakeholder Management and Organizational Change Management leadership.
Working knowledge of Secure Software Development Lifecycle (SSDLC).
Certification in code and dependency scanning.
Strong facilitation, writing, and stakeholder communication skills.
Substantial experience managing complex technology, cybersecurity, or application security programs across multiple teams, delivering through influence and shared accountability.
Knowledge of software delivery and application security concepts, including security requirements, code and dependency scanning, vulnerability management, remediation, and risk treatment.
Ability to translate technical and policy issues into clear actions, owners, decisions, and management reporting.
Experience establishing repeatable processes, coordinating organizational change, using measures to improve performance, and managing competing priorities in an evolving program.
Experience implementing, operationalizing, or governing SSDLC practices across multiple development teams.

Tech Stack

Secure software development lifecycle (SSDLC)
GitHub
Governance Risk and Compliance (GRC)

Additional Details

Location: United States (remote)
Contract: through end of June 2027 (likely extension)
Time zone: remote work acceptable for candidates residing in EST or CST time zones
Work eligibility: cannot accept candidates requiring C2C or requiring sponsorship for a work visa

Why This Role

Impact the trajectory of application security in the State of Maine by supporting integrity and confidentiality of critical systems.
Work within a large IT enterprise supporting critical State applications.
Contribute to protecting citizens’ data and enabling secure operation of essential government services.

Why Candidates May Like It

Immersion in rapidly evolving state government issues with a fast-moving organization.
Collaboration with peers and exposure to creative problem-solving approaches.
Opportunities to tackle unique and complex projects in application security.

View full job page →

2d ago

Application Security Sr. Associate Analyst

Truist Bank Charlotte, NC

Charlotte, NC

2d ago

Full time Ai Security Application Security Automated Security Testing

Apply Now

Job Description

Join Truist Bank’s Application Security team in Charlotte, NC onsite to support developer enablement, application security coordination, and AppSec automation.

Responsibilities

Learn how the team supports developers across AppSec disciplines including SAST, SCA, cloud and container scanning, OSINT, and DevSecOps automation
Support routine developer questions under guidance while building understanding of day-to-day priorities
Help create and maintain developer training, secure-coding guidance, and self-service enablement content
Assist with managing team processes and workflows to streamline operations, including measuring Key Performance Indicators and Key Risk Indicators (KPI/KRI)
Support security tool and pipeline integration workflows and communicate outcomes to stakeholders
Help build and maintain metrics, dashboards, and reporting for vulnerability posture and remediation progress
Develop automation solutions to streamline evidence collection, data gathering, and repetitive tasks with guidance from senior team members
Gather, organize, and review data from multiple tools and sources to support insights and reporting
Apply AI and automation tools to improve triage, reporting, and enablement efficiency
Assist with managing the team’s book of work, including tracking priorities, deadlines, milestones, and deliverables
Identify potential risks, delays, or concerns and ensure they are communicated and escalated in advance
Create and maintain tracking artifacts, training materials, guidance, and other resources for team members and business partners
Document processes, procedures, and workflows for clarity, sharing, and reuse
Coordinate team activities and support work progression against established timelines
Contribute to status reporting and visibility into progress and key priorities
Identify opportunities to improve or streamline processes and reduce repetitive work
Use AI and automation tools to strengthen efficiency, reporting, communication, and overall team support

Requirements

Bachelor’s degree in Information Technology, Computer Science, or a related field (or equivalent education, training, and work-related experience)
At least 2 years of experience in business systems analysis, system support, or related roles within enterprise technology environments
Strong understanding of business process analysis, requirements gathering, and documentation
Knowledge of enterprise systems, software development lifecycle, and support processes
Relevant certifications such as CBAP, CCBA, or equivalent are preferred

Technologies

SAST
SCA
Cloud and container scanning
Security tool pipeline integration
OSINT
DevSecOps automation
AI and automation tools
AI/ML tools and frameworks (e.g., LLM APIs, prompt-based automation)
ServiceNow VR
LLM APIs

Benefits

Medical
Dental
Vision
Life insurance
Disability
Accidental death and dismemberment
Tax-preferred savings accounts
401k plan
No less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during the first year of employment
10 sick days (also prorated)
Paid holidays
Defined benefit pension plan (depending on the position and division)
Restricted stock units (depending on the position and division)
Deferred compensation plan (depending on the position and division)

Regular employment type
Location: Charlotte, NC (onsite)
Work shift: 1st shift (United States of America)
Language fluency: English (Required)

Preferred Qualifications

Degree or coursework in Computer Science, Software Engineering, Cybersecurity, or a related field
Hands-on experience through internships, project work, or security competitions (e.g., CTFs, hackathons)
Exposure to AI/ML tools and frameworks (e.g., LLM APIs, prompt-based automation)
Progress toward an entry-level security certification (e.g., Security+)
Exposure to vulnerability management platforms (e.g., ServiceNow VR)

View full job page →

8d ago

Security Engineer

Weather Group Television LLC Atlanta, GA

Atlanta, GA

8d ago

Full time Cloud Platforms Cyber Security Cybersecurity Operations

Apply Now

Job Description

The Security Engineer role at Weather Group Television LLC supports the engineering and operational readiness of security solutions across On-Premise, Hybrid, and Cloud-Based environments. The position focuses on implementing security technologies, maintaining services, and driving remediation using established frameworks and standards.

Role Focus

Design, deliver, and maintain security solutions and services aligned to relevant AMG standards and practices. Apply security frameworks and principles to improve security processes, help coordinate risk remediation, and contribute to the development of standards for future work.

Key Responsibilities

Engineer security solutions and services in alignment with relevant AMG standards and practices for On-Premise, Hybrid, and Cloud-Based environments.
Implement and support security technologies, including production support and documentation for network proxies, intrusion detection and prevention systems, remote access, second factor authentication, and security event monitoring.
Perform infrastructure and system hardening, including patch deployment and vulnerability management activities.
Own the design, delivery, and maintenance of new and existing security solutions or services, supporting compliance and contributing to relevant standards.
Use modern standards and global product-specific guidelines, security standards, design standards, and industry frameworks to guide security solution delivery.
Identify opportunities to optimize security processes, recommend improvements, and pursue automation where practical.
Coordinate and drive remediation of identified risks and control deficiencies.
Collaborate in a diverse, global environment by building strong relationships across a matrixed, geographically and culturally dispersed organization.
Provide flexibility for working outside regular office hours to support team calls and organizational meetings; weekend or late-night work may be required during project and early lifecycle support phases.
Provide technical leadership within assigned projects. No direct supervision responsibilities are included.

Required Qualifications

Intermediate skills in planning, designing, and solving complex security solutions and services.
Technical knowledge in designing and implementing security solutions across one or more domains, including:
- Network Security
- Cloud Security
- Identity & Access Management (IdAM)
- Application Security (Container Security tools, Docker, Kubernetes)
- Governance, Risk, and Compliance (GRC)
- Cloud-based or On-Premise SIEM and Vulnerability Management
Fluent English communication (written and verbal) with the ability to explain technical concepts effectively.
Strong interpersonal communication and organizational skills, including the ability to work within tight timeframes.
Ability to rapidly learn new and emerging technologies and help define engineering standards quickly.
Desire to work in a diverse, fast-paced environment.
Bachelor’s Degree in Computer Science, Engineering, IT, Mathematics, or a related field, or equivalent work experience.
1+ years of Information Security experience.
3+ years of demonstrated ability in an IT Engineering function.
Thorough knowledge of industry frameworks (NIST, ISO, etc.) and security fundamentals.
Technical proficiency with Google Cloud services and hybrid and on-premise security solutions, including Linux and Windows Operating Systems.
Technical proficiency writing custom tools and scripts using Python, Ansible, PowerShell, and related shell scripting, plus experience interacting with APIs.
Strong analytical and problem-solving skills.
Understanding of other technologies required to support a secure, enterprise-level infrastructure in line with security best practices.
Excellent time management, organization, and decision-making skills.
Ability to document processes, procedures, and security designs clearly and accurately for internal teams and customers.

Technologies and Frameworks

Network proxies; intrusion detection and prevention systems; remote access; second factor authentication
Security event monitoring; patch deployment; vulnerability management
NIST; ISO
Google Cloud services; Linux; Windows Operating Systems
Python; Ansible; PowerShell; APIs; shell scripting
Docker; Kubernetes
SIEM; GRC
CISSP, CISM, CISA
GCP Certification

Preferred Qualifications

Technical experience in global IT and Security environments.
At least one technical certification (for example, CISSP/CISM/CISA or GCP Certification).

Work Style

This role suits a self-starter with strong curiosity and creativity, focused on delivering security solutions and services. The position requires ambition to learn and the ability to contribute to engineering standards while working effectively in a fast-paced, diverse environment.

Location and Work Arrangement

Onsite role in Atlanta, GA.

View full job page →

9d ago

Senior Cybersecurity GRC Analyst

REPAY Atlanta, GA

Atlanta, GA

9d ago

Full time Senior Cybersecurity Tools GRC

Apply Now

Job Description

At REPAY, the Senior Cybersecurity GRC Analyst plays a central role in strengthening how the organization manages compliance, risk reporting, and evidence workflows. Reporting to the Manager of Cybersecurity GRC, this position focuses on GRC tool automation, Identity Governance and Administration (IGA) implementation, and improving how security posture information is delivered to internal and external stakeholders.

This onsite role is based in Atlanta, GA and centers on integrating and automating evidence/control processes across systems, improving risk visibility for senior leadership, and keeping customer-facing trust materials up to date.

Responsibilities

Partner with stakeholders to design, document, and enforce security policies, standards, and controls.
Align security practices with NIST CSF, NIST SP800-53, PCI-DSS, and SOC 2.
Automate the collection, validation, and continuous monitoring of control evidence from source systems and platforms to reduce manual evidence requests and keep evidence current.
Map controls once to multiple frameworks so that a single automated evidence stream supports NIST CSF, PCI-DSS, SOC 2, and SOX requirements.
Automate and present risk reports and dashboards for senior management to deliver actionable insight into organizational risk posture and compliance.
Work closely with the corporate compliance team to support cybersecurity questionnaires from clients, and improve and automate the client questionnaire workflow.
Serve as a subject matter expert during client and regulatory discussions across GRC and risk management topics.
Collaborate with platform owners and stakeholders to implement controls and security best practices.
Identify gaps, redundancies, and integration opportunities across the current cybersecurity and GRC technology stack, then recommend and implement enhancements.
Automate GRC workflows within existing GRC platforms, including control testing, evidence collection, policy attestations, risk register updates, and compliance reporting.
Lead or support Identity Governance and Administration (IGA) implementation and optimization, including access certifications, role-based access, joiner/mover/leaver workflows, and segregation of duties controls that support SOX, SOC 2, and PCI-DSS.
Support the phishing program, including simulation and awareness campaigns, user-reported phishing triage, and effectiveness metrics feeding into risk reporting.
Build integrations and automated data flows between GRC, IGA, ticketing, and security tools using APIs, scripting, or low-code approaches to reduce manual effort and improve data quality.
Develop business cases, roadmaps, and success metrics for tooling improvements, and track adoption and return on investment.
Own and enhance the customer-facing Trust Center by keeping security documentation, certifications (including SOC 2), policies, and standard questionnaire responses current, and streamlining customer access requests.

Requirements

Bachelor’s degree in computer science, Information Systems, or related field.
Cybersecurity certifications (e.g., CISSP, CISM, CISA) are a plus.
3+ years of experience in GRC roles, including hands-on GRC tool implementation and automation, preferably in technology organizations in financial services or related industries.
Hands-on experience supporting security compliance programs and associated tools across on-premises and cloud environments.
Experience managing projects, including timelines, resources, and stakeholder coordination.
Hands-on experience automating GRC processes and workflows within GRC platforms, such as control testing, evidence collection, and risk and compliance reporting.
Experience implementing IGA solutions (e.g., SailPoint, Saviynt, Okta Identity Governance, Microsoft Entra ID Governance), including access reviews and identity lifecycle workflows.
Experience supporting phishing prevention, simulation, and response programs (e.g., KnowBe4, Proofpoint, Microsoft Defender for Office 365).
Demonstrated ability to assess an existing security technology stack and drive measurable improvements through optimization, integration, and automation.
Experience managing or implementing a customer-facing Trust Center (e.g., SafeBase, Conveyor, Vanta Trust Center) to share security posture and compliance documentation with customers.
Strong understanding of SOX, AICPA SOC 1 and SOC 2, and PCI-DSS, as well as cybersecurity frameworks such as NIST CSF and NIST SP800-53.
Proficiency with GRC tools such as Hyperproof, Archer, ServiceNow, or similar platforms, including workflow and automation configuration.
Working knowledge of APIs, scripting (e.g., Python, PowerShell), or low-code tools to integrate and automate security and GRC platforms.
Strong understanding of software development practices and cloud environments to build credibility with technical teams.
Advanced expertise in Microsoft Excel and other office tools.
Exceptional presentation and communication skills.
Familiarity with reporting tools such as PowerBI or Sisense is a plus.
Ability to identify risk within technology solution architecture and design.
Ability to create and present actionable risk reports and dashboards for senior leadership.
Demonstrated ability to drive cross-team collaboration and deliver impactful change.
Self-motivated and focused on continuous improvement, with strong ownership of outcomes.
Ability to operate independently and create or adapt processes to meet organizational needs.
Analytical, pragmatic approach, including assessing problems, identifying root causes, and recommending solutions.
Collaborative mindset to work effectively with Engineering, IT Operations, Security, and Compliance.

Technologies

NIST CSF, NIST SP800-53, PCI-DSS, SOC 2, SOX
GRC tool automation
Identity Governance and Administration (IGA), SailPoint, Saviynt, Okta Identity Governance, Microsoft Entra ID Governance
Hyperproof, Archer, ServiceNow
APIs, Python, PowerShell, low-code tools, Scripting
AICPA SOC 1
Microsoft Excel, PowerBI, Sisense
KnowBe4, Proofpoint, Microsoft Defender for Office 365
Trust Center, SafeBase, Conveyor, Vanta Trust Center
Role-based access, joiner/mover/leaver workflows, segregation of duties controls, access certifications

Benefits

100% coverage of employee healthcare premiums
Life insurance
Disability insurance
Work-life balance resources
401(k) with employer match
Employee Stock Purchase Plan
Annual Bonus Program
All benefits go into effect day one

View full job page →

9d ago

ServiceNow Security Engineer

CACI Remote 🌍 Remote

Remote

9d ago

$105k - $231k/yr Full time Data Security Engineer Fedramp

Apply Now

Job Description

Support ServiceNow platform security through governance, authorization, continuous monitoring, and vulnerability management.

Responsibilities

Perform governance, compliance, and assurance activities to ensure ServiceNow aligns with NIST SP 800-53, NIST RMF, and FedRAMP across environments and instances.
Define, document, and assess security requirements for ServiceNow implementations, including control selection, tailoring, and technical implementation across instance configurations and workflows.
Build, configure, and enforce security controls such as ACLs, RBAC, Column-Level Encryption, encryption in transit, and IP address restrictions following the ServiceNow Hardening Guide.
Configure and monitor ServiceNow event and security telemetry and maintain SIEM integrations for continuous monitoring, alert correlation, and incident detection.
Support continuous monitoring for the ServiceNow boundary with automated evidence gathering, control validation, and recurring assessment activities.
Manage the POA&M lifecycle: document findings, assign technical owners, track milestones, validate remediation testing, and close security items.
Develop and maintain ATO packages for the ServiceNow ecosystem, including SSPs, technical boundary diagrams, control implementation summaries, and evidence artifacts.
Support internal and external security assessments by coordinating with SCAs, federal auditors, and 3PAOs during formal evaluations.
Partner with system owners, ISSOs, ServiceNow platform administrators, developers, and solution architects to implement controls and remediate audit findings.
Perform vulnerability management across the ServiceNow platform and integrations by reviewing patch levels, evaluating CVEs, prioritizing remediation, and tracking resolution timelines.
Validate and enforce secure configuration baselines using ServiceNow Instance Security Center (ISC) and security benchmarks such as CIS benchmarks and DISA STIGs.
Assist with security incident response for the ServiceNow environment, supporting triage, root-cause investigation, containment, and formal reporting.
Conduct log analysis using ServiceNow transaction logs, system logs, and administrative audit trails to detect anomalous activity and support federal logging mandates (e.g., OMB M-21-31).
Oversee user access controls, privileged access management, and SSO/MFA configurations, including periodic user access recertifications.
Maintain configuration integrity and asset visibility within the CMDB aligned to RMF inventory and categorization standards.
Develop and maintain technical security architecture documentation, SOPs, and operational playbooks for platform security administration.
Formulate and execute project plans for deploying, upgrading, and maintaining ServiceNow security capabilities, modules, and platform updates.
Perform risk assessments and security impact evaluations for change requests, including plugin installations, update sets, custom integrations, and security policy exceptions.
Support secure development practices for custom ServiceNow applications and catalog items by conducting security reviews of Script Includes, Business Rules, client scripts, and automated test pipelines.
Use threat intelligence feeds to refine security workflows, identify emerging platform threats, and enhance incident containment playbooks.
Track, aggregate, and report security posture metrics such as instance hardening scores, vulnerability remediation timelines, POA&M aging, and audit compliance rates using ServiceNow dashboards and reporting tools.

Requirements

Ability to obtain Department of Homeland Security (DHS) Entry On Duty (EOD).
B.A./B.S. or equivalent plus 15 years of relevant experience.
Experience supporting ServiceNow development.
Understanding of NIST SP 800-53, RMF, FedRAMP, and federal security control frameworks.
Hands-on experience supporting ATO packages, SSP development, control implementation statements, and evidence collection.
Experience performing security assessments, vulnerability analysis, risk assessments, and remediation tracking.

Technologies

ServiceNow
NIST SP 800-53
NIST RMF
FedRAMP
SIEM
ServiceNow Hardening Guide
Access Control Lists (ACLs)
Role-Based Access Control (RBAC)
Column-Level Encryption
Encryption in transit
ServiceNow Instance Security Center (ISC)
CIS benchmarks
DISA STIGs
Plan of Action and Milestones (POA&M)
Authorization to Operate (ATO)
System Security Plans (SSPs)
Security Control Assessors (SCAs)
Third-Party Assessment Organizations (3PAOs)
SSO/MFA
ServiceNow Configuration Management Database (CMDB)
OMB M-21-31

Benefits

Healthcare
Wellness
Financial
Retirement
Family support
Continuing education
Time off benefits
Flexible time off
Robust learning resources

Desired

CISSP, CCSP, CEH, CySA+, or AWS/Azure security certifications (highly desired)

Pay Range

USD 105,100 - 231,100 per year

Location: Remote
Time type: Full time
Employee type: Regular
Travel: None
Minimum clearance required to start: None

View full job page →

15d ago

Application Security Operations Specialist

Bank of America Washington, DC

Washington, DC

15d ago

Full time Ai Security Application Security Data Analysis

Apply Now

Job Description

Own operational execution and continuous improvement of application security scanning and verification across the organization.

Responsibilities

Run automated and custom scan routines to detect application and source code vulnerabilities.
Provide operational support for new frontier AI models and related testing harnesses.
Support event and result handling, including identification, triage, resolution, false positive determination, verification, and closure in coordination with partners and Enterprise Remediation Governance.
Participate in incident response activities and contribute relevant information to improve collaboration with control owners and remediation teams.
Assist application teams with understanding and resolving security findings.
Contribute to the development and implementation of application security technology strategy.
Conduct proof-of-concept testing for next-generation scanning technologies.
Optimize scanning platforms and improve resiliency through operational process improvements.
Identify and map vulnerability detection gaps to appropriate technology solutions.
Perform data and trend analysis to inform harness development and vulnerability management lessons learned.

Requirements

3+ years experience driving and/or supporting tool integration with workflow platforms (example: ServiceNow).
Strong understanding of vulnerability management concepts and terminology.
Excellent prioritization, communication, and mentoring skills.

Technologies

ServiceNow
MITRE ATT&CK
NIST
FFIEC
Python, PowerShell, Bash
Windows, UNIX

Desired Qualifications

BS/MS in Information Technology, Cybersecurity, or a related field.
Familiarity with MITRE ATT&CK, cloud-based scanning, and compliance frameworks (example: NIST, FFIEC).
Experience with vulnerability rating methodologies.
Background in Windows and UNIX administration.
Proficiency with scripting languages (example: Python, PowerShell, Bash).
Hands-on experience with AI-assisted vulnerability identification activities.