Vulnerability Management Engineer; ServiceNow; Mid-Atlantic region; Remote

Build and operate Service Now Security Operations capabilities that help client organizations identify, prioritize, and remediate vulnerabilities and other exposures. The work spans vulnerability lifecycle engineering, integrations, automation, and reporting, with an emphasis on connecting technical risk to business and asset context.

• Configure Vulnerability Response workflows from scanner-data intake and deduplication through assignment, remediation, exception handling, verification, and closure.
• Create remediation flows, vulnerability groups, assignment rules, and risk calculators using Service Now platform tools.
• Develop risk-based prioritization that can account for vulnerability severity, threat information, exploitability, and business or asset criticality.
• Integrate vulnerability scanners and security tools into remediation processes, and use CMDB, Discovery, or Service Mapping context where applicable.
• Coordinate remediation with security, infrastructure, and application teams; build dashboards and SLA reporting to track progress and risk.
• Automate manual work and support related Security Operations capabilities, such as incident response or configuration compliance when in scope.

• Strong Service Now Security Operations engineering skills, including Vulnerability Response configuration and workflow development.
• Scripting and integration experience; the source cites JavaScript, HTML/CSS, and Python among relevant tools.
• Ability to analyze and prioritize vulnerabilities and coordinate remediation across technical teams.
• Ability to lead through influence, communicate with clients or internal stakeholders, and connect technical work to business priorities.
• Up to 10% travel; work involves extended computer use and close visual attention.

• Service Now Certified Application Specialist certification, or an Implementation Specialist certification in areas such as Vulnerability Response, Security Incident Response, Risk and Compliance, or Vendor Risk Management.
• Experience with scanner or security platforms such as Qualys, Tenable, Rapid7, Defender, or Crowd Strike.