Staff Product Security Engineer, PSIRT
ServiceNow2 days ago
Hyderābād, IndiaStaff+
Responsibilities
- Lead technical and organizational response during significant product security events and coordinate ownership, prioritization, and handoffs.
- Drive coordinated remediation across affected releases and verify that fixes and mitigations are complete before release.
- Support CVE assignment, scoring, advisory development, publication timing, and technical review of disclosure materials.
- Conduct deep-dive vulnerability investigations, exploit analysis, proof-of-concept development, and root-cause analysis.
- Author post-incident analyses, drive lessons learned to closure, and contribute to security process, SDLC, and technical improvements.
- Participate in on-call coverage and coordinate fix implementation across engineering, product, and test/release teams.
Requirements
- Minimum 8 years of related experience with a bachelor's degree, 6 years with a master's degree, 3 years with a PhD, or equivalent experience.
- At least 4 years of experience auditing source code for security vulnerabilities.
- Demonstrated leadership during significant security events or major incidents and willingness to participate in on-call coverage.
- Ability to read and understand Java and JavaScript code and common vulnerabilities in both languages.
- Proficiency scripting in Python and JavaScript for data gathering, processing, and visualization.
- Experience developing proof-of-concept exploits for web application vulnerabilities and distinguishing real exploitability from theoretical risk.
- Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
- Proficiency conducting product security investigations and root-cause analysis across design, code, configuration, and operational layers.
- Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.
- Preferred qualifications include PSIRT or similar experience at a major software or SaaS platform, recognized product security or application security expertise, ServiceNow platform vulnerability assessment experience, and knowledge of AI attack vectors, software supply chain security, SDLC tooling security, cloud infrastructure, and containerized environments.
- Relevant security certifications such as OSWE or equivalent demonstrated expertise are preferred.
Benefits
- Regular employee position in the APAC region with a flexible work persona.
- Scheduled coverage is Sunday, Monday, Tuesday, Friday, and Saturday, with additional coverage potentially required during significant incidents.
- ServiceNow supports a distributed work environment with flexible, remote, or office-based work personas depending on role and location.
Categories
About ServiceNow
ServiceNow builds a cloud platform for enterprise digital workflows, covering IT service management, customer service, HR service delivery, security operations, and operations management, plus tools for custom app development. It sells subscription SaaS to large organizations and public-sector agencies to automate processes and connect data across systems. Founded in 2004 and headquartered in Santa Clara, California, ServiceNow is a public company listed on the NYSE under the ticker NOW.