Lead incident response at ServiceNow remotely, using digital forensics and threat hunting to protect production and regulated environments.
As a Staff or Principal engineer, you will monitor defensive tools, correlate events, and lead customer-impacting incident response. The work spans security operations, forensic analysis, vulnerability assessment, and cloud security. You will also integrate AI into workflows, decisions, or problem-solving when appropriate.
Key Responsibilities: Monitor tools defending production and regulated environments
Lead incidents across functional teams through closure
Produce forensic reports and remediation plans
Maintain playbooks, handbooks, and cybersecurity standards
Participate in on-call rotations and after-hours response
Requirements: Seven to ten-plus years of related experience
Experience with digital forensics, threat hunting, and intelligence
Knowledge of Splunk, EDR, and SOAR tools
Experience with Windows, macOS, or Linux forensics
Eligibility for Canadian Reliability Status screening
Apply incident response, forensic analysis, and threat hunting expertise to safeguard ServiceNow customers and regulated environments.