Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)
ServiceNow20 hours ago
Base Salary
$181k - $317k/yr
Responsibilities
- Provide technical and organizational leadership during significant product security incidents.
- Coordinate incident response with incident commanders, security leadership, engineering, product, release, and customer-facing teams.
- Drive remediation across affected releases and verify that fixes and mitigations are complete before release.
- Lead CVE assignment, scoring, advisory content, coordinated disclosure, and publication timing.
- Collaborate with external researchers, vendors, and security partners on multi-party disclosures.
- Conduct technical reviews of advisories, researcher reports, and disclosure materials.
- Author postmortems, drive lessons learned to closure, and translate findings into process and technical improvements.
- Contribute to product security risk tracking, SDLC improvements, and secure development practices.
- Provide scheduled coverage across specified evening and overnight UTC shifts and additional coverage during significant incidents.
Requirements
- Bachelor’s degree with 12 years of related experience, or a master’s degree with 8 years, or a PhD with 5 years, or equivalent experience.
- At least 5 years of auditing source code for security vulnerabilities.
- Demonstrated leadership during significant security events or major incidents and willingness to participate in on-call coverage.
- Ability to read and comprehend Java and JavaScript code and understand common vulnerabilities in both languages.
- Proficiency in Python and JavaScript scripting for data gathering, processing, and visualization.
- Experience developing proof-of-concept exploits for web application vulnerabilities.
- Ability to communicate complex security risks clearly to technical teams and leadership.
- Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
- Proficiency in product security investigations, root-cause analysis, exploit analysis, and proof-of-concept development.
- Familiarity with SaaS threat models, secure development practices, SDLC integration, and CI/CD pipelines.
- Experience leading a CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication.
- Experience integrating AI into work processes, decision-making, or problem-solving.
- Preferred: PSIRT or comparable experience for a major software or SaaS platform.
- Preferred: recognized expertise in product security incident response, vulnerability research, or application security.
- Preferred: experience assessing vulnerabilities on the ServiceNow platform.
- Preferred: experience with AI-specific attack vectors, software supply chain security, SDLC tooling security, cloud infrastructure, and containerized environments.
- Preferred: relevant security certification such as OSWE or equivalent expertise.
Benefits
- Base pay is listed as $181,200 to $317,100 annually, plus equity where applicable, variable/incentive compensation, and benefits.
- Benefits include health plans, flexible spending accounts, a 401(k) plan with company match, ESPP, matching donations, flexible time away, and family leave programs.
- The role has a flexible work persona and is a regular employee position.
- Coverage is scheduled across specified Sunday-through-Tuesday and Friday-through-Sunday UTC evening/overnight shifts, with additional coverage potentially required during significant incidents.
Categories
About ServiceNow
ServiceNow builds a cloud platform for enterprise digital workflows, covering IT service management, customer service, HR service delivery, security operations, and operations management, plus tools for custom app development. It sells subscription SaaS to large organizations and public-sector agencies to automate processes and connect data across systems. Founded in 2004 and headquartered in Santa Clara, California, ServiceNow is a public company listed on the NYSE under the ticker NOW.