Senior Staff Product Security Engineer – Product Security Incident Response Team

This is a fully remote position, open to applicants in California.

📋 Description

• Act as a senior technical authority within the Product Security Incident Response Team (PSIRT)

• Lead comprehensive investigations into post-release vulnerabilities in ServiceNow products and services

• Facilitate resolution efforts among engineering, product, and release teams

• Exhibit technical and organizational leadership during critical security incidents

• Collaborate with incident commanders, business information security leadership, engineering, and customer-facing teams

• Maintain accountability, prioritize workstreams, and manage hand-offs during incidents

• Drive a coordinated response across impacted releases and minimize exposure windows

• Advance fixes through the release pipeline and confirm fix completeness prior to release

• Manage the CVE disclosure process, which includes assignment, scoring, advisory content, and publication timing

• Work with external security partners, vendors, and researchers on coordinated disclosures

• Review external advisories, researcher reports, and joint disclosure materials for technical accuracy

• Represent PSIRT's technical stance in coordinated disclosures and engagements with researchers

• Write postmortems and ensure lessons learned are implemented

• Engage in retrospectives and convert findings into process and technical enhancements

• Assist in tracking product security risk themes and trends

• Integrate incident learnings into secure development practices and enhance the SDLC

• Provide coverage during specified UTC shifts, with potential additional coverage required during major incidents

⛳️ Requirements

• Experience in utilizing or critically analyzing the integration of AI into work processes, decision-making, or problem-solving

• A minimum of 12 years of relevant experience with a Bachelor's degree; or 8 years with a Master's degree; or a PhD with 5 years of experience; or equivalent experience

• At least 5 years of experience in auditing source code for security vulnerabilities

• Proven leadership during significant security events or major incidents, with a readiness to participate in on-call duties

• Ability to read and understand Java and JavaScript code

• Strong grasp of common vulnerabilities in Java and JavaScript

• Proficient in scripting with both Python and JavaScript for data collection, processing, and visualization

• Experience in developing proof-of-concept exploits for web application vulnerabilities

• Capable of articulating complex security risks to technical teams and leadership in both written and verbal formats

• Experience in leading fix implementation and coordinating releases among engineering, product, and testing/release teams

• Proficient in conducting in-depth product security investigations and root-cause analyses across design, code, configuration, and operational layers

• Able to perform exploit analysis and develop proof-of-concept scenarios that differentiate real exploitability from theoretical risk

• Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices

• Experienced in managing a CVE disclosure process, including CVE assignment, scoring (CVSS), and advisory publication

• Preferred: experience in a PSIRT or similar role for a major software or SaaS platform

• Preferred: recognized expertise in product security incident response, vulnerability research, or application security

• Preferred: experience conducting vulnerability assessments on the ServiceNow platform

• Preferred: experience with AI-specific attack vectors, software supply chain security, and SDLC tooling security

• Preferred: experience with AWS, Azure, GCP, and containerized environments

• Preferred: relevant security certifications such as OSWE or equivalent expertise

🏝️ Benefits

• Equity (when applicable)

• Variable/incentive compensation

• Health plans

• Flexible spending accounts

• 401(k) Plan with company match

• Employee Stock Purchase Plan (ESPP)

• Matching donations

• Flexible time away plan

• Family leave programs

• Flexible work persona