Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)
ServiceNow1 day ago
Base Salary
$201k - $352k/yr
Responsibilities
- Lead technical and organizational response during significant product security incidents.
- Coordinate incident ownership, prioritization, hand-offs, remediation, and release activities across engineering, product, security, test, and customer-facing teams.
- Drive CVE assignment, scoring, advisory development, coordinated disclosure, and publication timing.
- Conduct deep-dive investigations, exploit analysis, root-cause analysis, and fix-completeness verification.
- Collaborate with external researchers, vendors, security partners, and other parties on coordinated disclosures.
- Author postmortems, lead retrospectives, and drive security process and technical improvements to closure.
- Contribute to portfolio-wide product security risk trends and secure development improvements.
- Provide incident coverage during the stated evening and overnight UTC schedules and additional coverage when significant incidents require it.
Requirements
- Minimum 12 years of related experience with a bachelor's degree, 8 years with a master's degree, 5 years with a PhD, or equivalent experience.
- At least 5 years auditing source code for security vulnerabilities.
- Demonstrated leadership during significant security events or major incidents and willingness to participate in on-call coverage.
- Ability to read and understand Java and JavaScript code and their common vulnerabilities.
- Proficiency scripting in Python and JavaScript for data gathering, processing, and visualization.
- Experience developing proof-of-concept exploits for web application vulnerabilities.
- Experience leading fix implementation and release coordination across engineering, product, and test or release teams.
- Proficiency in product security investigations, root-cause analysis, exploitability analysis, and proof-of-concept development.
- Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
- Experience leading CVE disclosure processes, including CVE assignment, CVSS scoring, and advisory publication.
- Preferred: PSIRT, vulnerability research, application security, or major software or SaaS platform experience.
- Preferred: ServiceNow platform vulnerability assessment experience; experience with AI-specific attack vectors, software supply-chain security, SDLC tooling security, AWS, Azure, GCP, and containerized environments.
- Preferred: OSWE or another relevant security certification, or demonstrated equivalent expertise.
- Experience integrating AI into work processes, decision-making, or problem-solving.
Benefits
- Base pay of $201,300 - $352,300, plus equity when applicable, variable or incentive compensation, and benefits.
- Health plans including flexible spending accounts, a 401(k) plan with company match, ESPP, matching donations, flexible time away, and family leave programs.
- Flexible work persona with distributed-work flexibility; employee type is regular.
- Scheduled coverage includes evening and overnight UTC shifts, with possible additional coverage during significant incidents.
Categories
About ServiceNow
ServiceNow builds a cloud platform for enterprise digital workflows, covering IT service management, customer service, HR service delivery, security operations, and operations management, plus tools for custom app development. It sells subscription SaaS to large organizations and public-sector agencies to automate processes and connect data across systems. Founded in 2004 and headquartered in Santa Clara, California, ServiceNow is a public company listed on the NYSE under the ticker NOW.