ServiceNow Security Engineer

Support Service Now platform security through governance, authorization, continuous monitoring, and vulnerability management.

• Perform governance, compliance, and assurance activities to ensure Service Now aligns with NIST SP 800-53
  , NIST RMF
  , and FedRAMP across environments and instances.
• Define, document, and assess security requirements for Service Now implementations, including control selection, tailoring, and technical implementation across instance configurations and workflows.
• Build, configure, and enforce security controls such as ACLs
  , RBAC
  , Column-Level Encryption
  , encryption in transit
  , and IP address restrictions following the Service Now Hardening Guide
  .
• Configure and monitor Service Now event and security telemetry and maintain SIEM integrations for continuous monitoring, alert correlation, and incident detection.
• Support continuous monitoring for the Service Now boundary with automated evidence gathering, control validation, and recurring assessment activities.
• Manage the POA&M lifecycle: document findings, assign technical owners, track milestones, validate remediation testing, and close security items.
• Develop and maintain ATO packages for the Service Now ecosystem, including SSPs
  , technical boundary diagrams, control implementation summaries, and evidence artifacts.
• Support internal and external security assessments by coordinating with SCAs
  , federal auditors, and 3
  
  PAOs during formal evaluations.
• Partner with system owners, ISSOs, Service Now platform administrators, developers, and solution architects to implement controls and remediate audit findings.
• Perform vulnerability management across the Service Now platform and integrations by reviewing patch levels, evaluating CVEs, prioritizing remediation, and tracking resolution timelines.
• Validate and enforce secure configuration baselines using Service Now Instance Security Center (ISC) and security benchmarks such as CIS benchmarks and DISA STIGs
  .
• Assist with security incident response for the Service Now environment, supporting triage, root‑cause investigation, containment, and formal reporting.
• Conduct log analysis using Service Now transaction logs, system logs, and administrative audit trails to detect anomalous activity and support federal logging mandates (e.g.,
  OMB M-21-31
  ).
• Oversee user access controls, privileged access management, and SSO/MFA configurations, including periodic user access recertifications.
• Maintain configuration integrity and asset visibility within the CMDB aligned to RMF inventory and categorization standards.
• Develop and maintain technical security architecture documentation, SOPs, and operational playbooks for platform security administration.
• Formulate and execute project plans for deploying, upgrading, and maintaining Service Now security capabilities, modules, and platform updates.
• Perform risk assessments and security impact evaluations for change requests, including plugin installations, update sets, custom integrations, and security policy exceptions.
• Support secure development practices for custom Service Now applications and catalog items by conducting security reviews of Script Includes, Business Rules, client scripts, and automated test pipelines.
• Use threat intelligence feeds to refine security workflows, identify emerging platform threats, and enhance incident containment playbooks.
• Track, aggregate, and report security posture metrics such as instance hardening scores, vulnerability remediation timelines, POA&M aging, and audit compliance rates using Service Now dashboards and reporting tools.

• Ability to obtain Department of Homeland Security (DHS) Entry On Duty (EOD).
• B.A./B.S. or equivalent plus 15 years of relevant experience.
• Experience supporting Service Now…