Senior Staff Product Security Engineer – Product Security Incident Response Team

This is a fully remote position, open to applicants in California.

📋 Description

• Act as a senior technical authority within ServiceNow's Product Security Incident Response Team (PSIRT)

• Conduct thorough investigations of product vulnerabilities post-release

• Facilitate the resolution process among engineering, product, and release teams

• Offer technical and organizational leadership during critical security incidents

• Collaborate with incident commanders, business information security leaders, engineering, and customer-facing teams

• Steer coordinated responses across impacted releases and minimize exposure periods

• Manage fixes through the release pipeline and confirm the completeness of mitigations

• Oversee the CVE disclosure process, including assignment, scoring, advisory content, and publication timing

• Coordinate disclosures with external security partners, vendors, and researchers

• Assess external advisories, researcher reports, and joint disclosure content for technical accuracy

• Represent PSIRT's technical stance in coordinated disclosures and engagements with researchers

• Write postmortems and ensure that lessons learned are addressed

• Engage in retrospectives and convert findings into process and technical enhancements

• Monitor product security risk themes and trends across the portfolio

• Integrate incident learnings into secure development practices and improvements in the SDLC

• Provide incident-response coverage during specified UTC shifts and additional support for significant incidents

⛳️ Requirements

• Experience in integrating AI into workflows, decision-making, or problem-solving

• At least 12 years of relevant experience with a Bachelor's degree; or 8 years with a Master's degree; or a PhD with 5 years of experience; or equivalent experience

• Minimum of 5 years auditing source code for security vulnerabilities

• Proven leadership during major security incidents or significant events

• Willingness to be part of an on-call rotation

• Capability to read and understand Java and JavaScript code

• Strong grasp of common vulnerabilities in Java and JavaScript

• Proficiency in Python and JavaScript scripting

• Experience in developing proof-of-concept exploits for web application vulnerabilities

• Ability to articulate complex security risks clearly to technical teams and leadership

• Experience leading the implementation of fixes and coordinating releases across engineering, product, and test/release teams

• Expertise in product security investigations and root-cause analysis across design, code, configuration, and operational layers

• Conducting exploit analysis and developing proof-of-concept exploits

• Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development methodologies

• Experience managing the CVE disclosure process, including CVE assignment, CVSS scoring, and advisory publication

• Preferred: Experience in PSIRT or a similar role for a major software or SaaS platform

• Preferred: Recognized expertise in product security incident response, vulnerability research, or application security

• Preferred: Conducting vulnerability assessments on the ServiceNow platform

• Preferred: Knowledge of AI-specific attack vectors, software supply chain security, and SDLC tooling security

• Preferred: Familiarity with AWS, Azure, GCP, and container environments

• Preferred: Relevant security certifications such as OSWE or equivalent expertise

🏝️ Benefits

• Equity (when applicable)

• Variable/incentive compensation

• Health plans

• Flexible spending accounts

• 401(k) Plan with company match

• Employee Stock Purchase Plan (ESPP)

• Matching donations

• Flexible time away plan

• Family leave programs

• Flexible work persona