Senior Staff Product Security Engineer | Product Security Incident Response Team (PSIRT)
ServiceNow20 hours ago
Base Salary
$201k - $352k/yr
Responsibilities
- Provide technical and organizational leadership during significant product security incidents.
- Coordinate incident ownership, prioritization, handoffs, and remediation across security, engineering, product, release, and customer-facing teams.
- Drive coordinated fixes across affected releases and verify that mitigations are complete before release.
- Lead CVE assignment, scoring, advisory development, publication timing, and coordinated disclosure activities.
- Collaborate with external security partners, vendors, and researchers on technical accuracy, timelines, and disclosure messaging.
- Conduct product security investigations, exploit analysis, proof-of-concept development, and root-cause analysis.
- Author postmortems, lead retrospectives, and drive security process and technical improvements to closure.
- Contribute incident learnings to secure development practices and portfolio-level product security risk tracking.
Requirements
- Minimum 12 years of related experience with a bachelor's degree, 8 years with a master's degree, 5 years with a PhD, or equivalent experience.
- At least 5 years of auditing source code for security vulnerabilities.
- Demonstrated leadership during significant security events or major incidents and willingness to participate in on-call coverage.
- Ability to read and understand Java and JavaScript code and common vulnerabilities in both languages.
- Proficiency in Python and JavaScript scripting for data gathering, processing, and visualization.
- Experience developing proof-of-concept exploits for web application vulnerabilities.
- Ability to communicate complex security risks clearly to technical teams and leadership.
- Experience leading fix implementation and release coordination across engineering, product, and test/release teams.
- Proficiency in deep-dive product security investigations, exploitability analysis, and root-cause analysis across design, code, configuration, and operational layers.
- Familiarity with SaaS threat models, SDLC integration, CI/CD pipelines, and secure development practices.
- Experience leading CVE disclosure processes, including CVE assignment, CVSS scoring, and advisory publication.
- Preferred qualifications include PSIRT or comparable experience at a major software or SaaS platform, recognized product security or vulnerability research expertise, ServiceNow platform vulnerability assessment experience, and experience with AI-specific attack vectors, software supply chain security, SDLC tooling security, AWS, Azure, GCP, or containerized environments.
- Relevant security certifications such as OSWE or equivalent demonstrated expertise are preferred.
Benefits
- Base pay is listed as $201,300 - $352,300, plus equity when applicable, variable or incentive compensation, and benefits.
- Benefits include health plans, flexible spending accounts, a 401(k) plan with company match, ESPP, matching donations, flexible time away, and family leave programs.
- The role has a flexible work persona and is a regular employee position.
- Scheduled coverage consists of evening and overnight UTC shifts across specified Sunday-through-Wednesday and Friday-through-Sunday periods, with additional coverage potentially required for significant incidents.
Categories
About ServiceNow
ServiceNow builds a cloud platform for enterprise digital workflows, covering IT service management, customer service, HR service delivery, security operations, and operations management, plus tools for custom app development. It sells subscription SaaS to large organizations and public-sector agencies to automate processes and connect data across systems. Founded in 2004 and headquartered in Santa Clara, California, ServiceNow is a public company listed on the NYSE under the ticker NOW.