ServiceNow Integrated Risk Management & Continuous Authorization & Monitoring Specialist

is a leased employee (part-time engagement) to be provided on a 100% remote basis for a duration of up to 24 months.

• Review, Consult, and Develop: Reviewing, consulting on, improving, and continuing the development of existing integrations to centralize organizational-level common control, business system, and application-level assessment & authorization packages, including security control attestation and evidence collection.
• Process Assessment and Optimization: Initiating and executing an independent project to assess the existing cybersecurity risk assessment process, current ticket assignment methodologies, prioritization, processing times, and average level of effort. This includes examining workflows to optimize/refine processes and establishing realistic processing expectancies for stakeholders based on request type.
• Standardization and Documentation: Proposing standardization improvements by helping establish cybersecurity risk documentation templates for stakeholders to use when initiating Service Now ticket requests more efficiently. Reviewing historical metrics to identify trends (e.g., peak submission times) and proposing efficiencies to manage the ticket queue within resource constraints.
• Stakeholder
  
  Collaboration:
  
  Collaborating directly with Client's Cybersecurity Awareness, Training, and Education program to raise user awareness regarding tickets requiring risk review. Engaging organizational stakeholders to ensure smooth process development and implementation across the organization for risk assessment functions.
• Pilot Execution: Helping execute the initial organizational pilot of the RMF process leveraging Service Now IRM and CAM modules, including the assignment and refinement of security control processes (organization-level, system-level, hybrid controls), security artifact/evidence requirements, and providing recommendations for continuous monitoring.
• Governance Participation: Attending Client's weekly Service Now platform enhancement reviews and weekly Service Now change management review board meetings as needed to support change requests or new items brought forward by the Cybersecurity Risk Team. These meetings are supported remotely via MS Teams.

• The documents require a leased employee with a minimum of four (4) years' experience developing, analyzing, and creating efficiencies within Service Now workflow processes. Additionally, the candidate must have at least three (3) years' experience customizing Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) capabilities within Service Now to align with business objectives and risk appetite of mid to large-sized organizations.
  
  The role also demands a minimum of three (3) years' experience working within a governance, risk, and compliance (GRC) environment, executing corporate projects, and engaging organizational stakeholders for risk assessment functions. Furthermore, the candidate must have demonstrated experience developing professional templates to support organizational-level, cybersecurity-focused risk assessment processes.

• The documents list several desirable qualifications including Service Now Practitioner Implementer or above, Service Now Certified System Administrator (CSA), Service Now GRC:
  Integrated Risk Management (IRM) Implementer, Service Now Certified Technical Architect (CTA), ISC2 CISSP, ISC2 CGRC or CAP, ISACA CISM, ISACA CRISC, CompTIA CASP+, CompTIA Security+, and a B.S. in Computer Science, MIS, or Cybersecurity from an accredited university.

• The documents require the candidate to have a strong foundational understanding of NIST's Cybersecurity (CSF) and Risk Management Frameworks (RMF), including hands-on experience aligning CSF and RMF functions within Service Now IRM/CAM modules. The role also requires recent engagement with Service Now IRM (minimum 3 years' experience) and active engagement with Service Now CAM (minimum 1 year continuous operation).

• The role requires a strong understanding of NIST's CSF and RMF, including familiarity with navigating Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53). The specialist must possess strong communication, written, and collaboration skills to articulate highly technical information to the project team both verbally and in writing.

• The role is…