Senior Staff Product Security Engineer – Product Security Incident Response Team

This is a fully remote position, open to applicants in Washington.

📋 Description

• Act as a senior technical leader within the Product Security Incident Response Team (PSIRT)

• Conduct in-depth investigations into post-release vulnerabilities in ServiceNow-developed products and services

• Facilitate resolution efforts among engineering, product, and release teams

• Offer technical and organizational guidance during major security incidents

• Collaborate with incident commanders, business information security leaders, engineering, and customer-facing teams

• Manage a coordinated response across impacted releases while assessing risk and remediation viability

• Navigate fixes through the release pipeline and confirm the completeness of fixes prior to release

• Oversee ServiceNow's CVE disclosure process, which includes assignment, scoring, advisory content, and timing of publications

• Work with external security partners, vendors, and researchers on coordinated disclosures

• Evaluate external advisories, researcher reports, and joint disclosure content for technical precision

• Represent PSIRT's technical stance in multi-party disclosures and engagements with researchers

• Write postmortems and ensure lessons learned are fully addressed

• Engage in retrospectives and convert findings into process and technical enhancements

• Assist in monitoring product security risk themes and trends across the portfolio

• Integrate incident insights into secure development practices and improvements in the SDLC

• Provide incident-response coverage during designated UTC shifts and additional support for significant incidents when required

⛳️ Requirements

• Experience in leveraging or critically evaluating the integration of AI into work processes, decision-making, or problem-solving

• At least 12 years of relevant experience with a Bachelor's degree; or 8 years with a Master's degree; or a PhD with 5 years of experience; or equivalent experience

• A minimum of 5 years auditing source code for security vulnerabilities

• Proven leadership during notable security events or major incidents, with a readiness to participate in on-call duties

• Capability to read and understand Java and JavaScript code

• Strong grasp of common vulnerabilities in Java and JavaScript

• Skilled in scripting with both Python and JavaScript for data collection, processing, and visualization

• Development of proof-of-concept exploits for web application vulnerabilities

• Ability to communicate complex security risks clearly in writing and verbally to technical teams and leadership

• Experience leading the implementation of fixes and coordinating releases among engineering, product, and testing/release teams

• Expertise in conducting deep-dive product security investigations and root-cause analysis across design, code, configuration, and operational layers

• Analyze exploits and develop proof-of-concept exploits to differentiate between actual exploitability and theoretical risk

• Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices

• Experience leading a CVE disclosure process, including CVE assignment, scoring (CVSS), and advisory publication

• Preferred: experience in a PSIRT or similar role within a major software or SaaS platform

• Preferred: recognized expertise in product security incident response, vulnerability research, or application security within a software or SaaS context

• Preferred: experience performing vulnerability assessments on the ServiceNow platform

• Preferred: familiarity with emerging threats, including AI-specific attack vectors, software supply chain security, and SDLC tooling security

• Preferred: experience with cloud infrastructure (AWS, Azure, GCP) and containerized environments

• Preferred: relevant security certifications such as OSWE or demonstrated equivalent expertise

🏝️ Benefits

• Equity (when applicable)

• Variable/incentive compensation

• Health plans

• Flexible spending accounts

• 401(k) Plan with company match

• Employee Stock Purchase Plan (ESPP)

• Matching donations

• Flexible time away plan

• Family leave programs