Protect ServiceNow production environments in Canada through incident response, threat hunting, and security automation expertise. Support commercial and regulated-market customers. This Staff Incident Response Engineer serves Cyber Investigation, Response & Automation within the ServiceNow Security Organization. The role monitors defensive tools, correlates events, and leads customer incident response. It requires digital forensics, threat intelligence, SIEM, and cloud security knowledge. Key Responsibilities:

Monitor defensive tools across production and regulated environments Lead customer incident response and track incidents to closure Produce forensic reports, post-incident reports, and remediation plans Maintain playbooks, handbooks, standards,



and configuration baselines Support audits, investigations, deployments, and on-call escalation Requirements:

Seven to ten or more years related experience Incident response, threat hunting, and digital forensics expertise Splunk, EDR, SOAR, and vulnerability scanning experience Python or bash scripting and systems hardening knowledge Eligibility for Government of Canada Reliability Status screening Bring defensive security leadership, forensic analysis, and automation skills to ServiceNow’s Canadian incident response team.

📌 Staff Incident Response Engineer Canada (Toronto)
🏢 Servicenow
📍 Toronto