Incident Response Engineer

It all started when engineer Fred Luddy wrote code that automated a tedious task for his coworker, Phyllis. She cried tears of joy. That moment inspired Fred to build a company that could do that for everyone- freeing people from busywork so they could focus on meaningful work. Today, Service Now is the AI control tower for business reinvention. Our Service Now AI platform brings together any AI, any data, and any workflow- helping 85% of the Fortune 500® work smarter, faster, and better.

We're building an AI-native culture where technology and talent are unstoppable together. And we're just getting started.

Join us to put AI to work for people.

What you get to do in this role:

This is a Staff Incident Response Engineer role on Service Now's Cyber Investigation, Response & Automation Team; supporting both the commercial and regulated-market customer environment in Canada. You will be a key member of the Cyber Investigation, Response & Automation Team; monitoring the tools and systems that defend Service Now's production and regulated environment, define relationships between seemingly unrelated events through deductive reasoning, come up with ways to do things faster, better and more effectively while maintaining a laser focus on quality.
We employ the brightest and most forward-thinking Security Professionals on the planet. We have offices around the world and work as a global team.

Eligibility:

Due to Government of Canada regulatory requirements, this position requires the successful completion of a Government of Canada Reliability Status screening as a condition of employment. The screening process requires 5 years of verifiable background history.

This includes identity verification, education verification, a criminal record check, and a credit check. Candidates must be eligible to obtain and maintain Reliability Status, which generally requires Canadian citizenship or Canadian permanent resident status. This role may require security clearance in the future. Employment is contingent upon successful completion and maintenance of the required screening.

Rotational and Non-Standard

Hours:

This role may require participation in a rotational schedule that includes non-standard business hours, weekends, and statutory holidays as the team provides 24x7 operational support.

The Service Now Security Organization (SSO)

The Service Now Security Organization (SSO) delivers world-class, innovative security solutions to reduce risk and protect the company and our customers. We enable our customers to migrate their most sensitive data and workloads to the cloud, accelerating our business so that we are the most trusted SaaS provider. We create an environment where our employees are proud to work and can make a positive impact

Key Responsibilities

• Monitor the tools and systems that defend Service Now's production and regulated environments, and correlate seemingly unrelated events
• Lead response to incidents affecting our customers, and track incidents to closure across functional teams
• Respond to account-level threats and attacks against our customer environments
• Produce post-incident reports, forensic reports, and remediation plans
• Support audits, compliance requirements, and regulatory investigations
• Build and maintain incident response playbooks, handbooks, and cybersecurity standards
• Maintain secure configuration baselines for devices under direct control (security tools) and those that aren't (workstations, servers, network devices), and analyze vulnerabilities using that data
• Serve as an escalation point and participate in the on-call rotation, including after-hours and weekends that might be out of standard business hours
• Assist with the deployment, integration and…