Lead incident response at ServiceNow remotely, using digital forensics and threat hunting to protect production and regulated environments. As a Staff or Principal engineer, you will monitor defensive tools, correlate events, and lead customer-impacting incident response. The work spans security operations, forensic analysis, vulnerability assessment, and cloud security. You will also integrate AI into workflows, decisions, or problem-solving when appropriate.
Key Responsibilities
- Monitor tools defending production and regulated environments
- Lead incidents across functional teams through closure
- Produce forensic reports and remediation plans
- Maintain playbooks, handbooks, and cybersecurity standards
- Participate in on-call rotations and after-hours response
Requirements:
- Seven to ten-plus years of related experience
- Experience with digital forensics, threat hunting, and intelligence
- Knowledge of Splunk, EDR, and SOAR tools
- Experience with Windows, macOS, or Linux forensics
- Eligibility for Canadian Reliability Status screening Apply incident response, forensic analysis, and threat hunting expertise to safeguard ServiceNow customers and regulated environments.