Security Incident Response Engineer; ServiceNow

Position: Security Incident Response Engineer (ServiceNow)
Security Incident Response Engineer (Service Now)

Contract:

6 Months (Likely Extension)

Location:

Hybrid
IR35:
Outside / LTD – £700PD
SC Cleared / BPSS

A highly reputable corporation is hiring an experienced Service Now Security Incident Response (SIR) Consultant to support the design, implementation and optimisation of a Security Incident Response capability for a Cyber Security Operations Centre (CSOC).

This is an excellent opportunity to play a key role in enhancing cyber incident management processes, automating security workflows and integrating Service Now Security Operations with wider security tooling.

Key Responsibilities

Service Now SIR Workflow Design & Development

Design and configure end-to-end Security Incident Response workflows.
Build workflows covering incident triage, escalation, investigation and case management.
Develop evidence management processes and structured incident life cycles.
Align workflows with Cyber Operations requirements, industry best practice and NCSC-aligned incident response processes.
Test, refine and optimise workflows to improve operational efficiency.
Essential Skills

Strong experience implementing and configuring Service Now Security Incident Response (SIR).
Expertise across Service Now Security Operations (Sec Ops).
Experience integrating Service Now with SIEM, SOAR, and Threat Intelligence platforms.
Strong knowledge of ITSM (Incident, Change and Problem Management).
Experience designing and automating security workflows and incident response processes.
Strong dashboard, reporting and analytics capabilities within Service Now.
Excellent stakeholder management, documentation and knowledge transfer skills.
Service Now SIR/Sec Ops certifications are desirable.
This is an opportunity to work on a high-profile cyber security programme where you'll have a direct impact on strengthening incident response capability, improving automation and helping shape the future Security Operations environment