Protect ServiceNow production environments in Canada through incident response, threat hunting, and security automation expertise. Support commercial and regulated-market customers.
This Staff Incident Response Engineer serves Cyber Investigation, Response & Automation within the ServiceNow Security Organization. The role monitors defensive tools, correlates events, and leads customer incident response. It requires digital forensics, threat intelligence, SIEM, and cloud security knowledge.
Key Responsibilities: Monitor defensive tools across production and regulated environments
Lead customer incident response and track incidents to closure
Produce forensic reports, post-incident reports, and remediation plans
Maintain playbooks, handbooks, standards, and configuration baselines
Support audits, investigations, deployments, and on-call escalation
Requirements: Seven to ten or more years related experience
Incident response, threat hunting, and digital forensics expertise
Splunk, EDR, SOAR, and vulnerability scanning experience
Python or bash scripting and systems hardening knowledge
Eligibility for Government of Canada Reliability Status screening
Bring defensive security leadership, forensic analysis, and automation skills to ServiceNow’s Canadian incident response team.