Staff Product Security Engineer, PSIRT
ServiceNow9 days ago
Hyderābād, IndiaStaff+
Responsibilities
- Lead technical and organizational response during significant product security events and major incidents.
- Conduct deep-dive investigations across design, code, configuration, and operational layers, including exploitability analysis and proof-of-concept development.
- Coordinate vulnerability remediation, fix implementation, release activities, ownership, prioritization, and hand-offs across engineering, product, test, and release teams.
- Verify remediation completeness and prevent incomplete mitigations from being released.
- Support CVE assignment, scoring, advisory development, publication timing, and technical reviews of disclosure materials.
- Author root cause analyses, lead retrospectives, and drive lessons learned and continuous-improvement actions to closure.
- Contribute product security risk trends, SDLC improvements, secure development practices, and upstream incident-response learnings.
- Participate in on-call coverage according to business needs, including additional coverage during significant incidents.
Requirements
- At least 8 years of related experience with a bachelor's degree, 6 years with a master's degree, 3 years with a PhD, or equivalent experience.
- At least 4 years of auditing source code for security vulnerabilities.
- Demonstrated leadership during significant security events or major incidents and willingness to participate in on-call coverage.
- Ability to read and comprehend Java and JavaScript code and understand common vulnerabilities in both languages.
- Proficiency in Python and JavaScript scripting for data gathering, processing, and visualization.
- Experience developing proof-of-concept exploits for web application vulnerabilities.
- Ability to communicate complex security risks clearly to technical teams and leadership.
- Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
- Proficiency in product security investigations, root-cause analysis, exploit analysis, and proof-of-concept development.
- Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
- Preferred experience in PSIRT or a similar function for a major software or SaaS platform.
- Preferred expertise in product security incident response, vulnerability research, or application security.
- Preferred experience conducting vulnerability assessments on the ServiceNow platform.
- Preferred experience with AI-specific attack vectors, software supply chain security, SDLC tooling security, cloud infrastructure, and containerized environments.
- Relevant security certifications such as OSWE or equivalent demonstrated expertise.
Benefits
- Flexible work persona within a distributed work environment, with eligibility determined by role and location.
- Regular employee position in the APAC region.
- Scheduled coverage is Sunday, Monday, Tuesday, Friday, and Saturday, with additional coverage potentially required for significant incidents.
Categories
About ServiceNow
ServiceNow builds a cloud platform for enterprise digital workflows, covering IT service management, customer service, HR service delivery, security operations, and operations management, plus tools for custom app development. It sells subscription SaaS to large organizations and public-sector agencies to automate processes and connect data across systems. Founded in 2004 and headquartered in Santa Clara, California, ServiceNow is a public company listed on the NYSE under the ticker NOW.