ServiceNow SecOps Specialist

This is a remote position.

• Employment Type: Contract
  
• Work Mode: Remote
  
• Location: Offshore
  
• Total Experience Required: 4 to 8 years
  
• Relevant Experience Required: 3+ years of dedicated implementation and configuration experience across ServiceNow Security Operations (SecOps) modules
  
• Mandatory Certification: ServiceNow Certified Implementation Specialist – Security Incident Response (CIS-SIR) or Vulnerability Response (CIS-VR)
  

• Configure and manage core ServiceNow SecOps modules, focusing on Security Incident Response (SIR), Vulnerability Response (VR), and Threat Intelligence integration.
  
• Design automated ingestion pipelines via Integration Hub, connecting ServiceNow with external SIEMs (e.g., Splunk, Sentinel), EDRs (e.g., CrowdStrike), and vulnerability scanners (e.g., Tenable, Qualys).
  
• Build complex security orchestration and playbooks within Flow Designer to automate initial validation containment tasks, asset lookups, and owner assignments.
  
• Implement Vulnerability Assignment Rules and Calculator Groups, prioritizing vulnerabilities dynamically using corporate asset criticality ratings and CVSS threat matrices.
  
• Establish strict data confidentiality controls, managing Access Control Lists (ACLs), read-permissions, and data isolation barriers to keep sensitive breach investigations restricted to authorized teams.
  
• Govern Configuration Item (CI) reconciliation matches, collaborating with CMDB data stewards to ensure incoming security event data maps correctly to existing infrastructure assets.
  
• Support end-to-end user acceptance testing (UAT), creating target test failure patterns, verifying playbook action workflows, and delivering analyst enablement training workshops.
  

Requirements

• 4 to 8 years of core enterprise IT or cybersecurity experience, with 3+ dedicated years actively designing, building, and maintaining configurations within the ServiceNow SecOps application suite.
  
• Strong technical mastery of JavaScript scripting, Flow Designer parameters, ServiceNow Glide API frameworks, JSON parsing structures, and REST/SOAP endpoint mappings.
  
• Deep structural understanding of cybersecurity incident response phases (NIST/SANS), the MITRE ATT&CK framework, common infrastructure vulnerability vectors, and CMDB hierarchy frameworks.
  
• Mandatory certification: ServiceNow CIS-SIR or CIS-VR.
  

• CompTIA Security+, CEH (Certified Ethical Hacker), or GCIH (GIAC Certified Incident Handler) designation.
  
• Prior experience implementing ServiceNow Major Security Incident Management (MSIM) frameworks or handling multi-tenant domain separation configurations.