Lead ServiceNow Architect - CMDB, VR & SIR

Lead Service Now Architect

Our client is seeking an architect-level Lead Service Now Architect to support the National Energy Technology Laboratory's implementation of Service Now Security Operations.

This hands-on position will lead three sequential work streams: maturing the Configuration Management Database and Common Service Data Model, implementing Vulnerability Response, and implementing Security Incident Response. The architect will also prepare documentation, manage project activities, and train staff.

CMDB and CSDM

• Document CMDB and Configuration Data Management requirements.
• Define Configuration Item types, attributes, relationships, identification and reconciliation rules, life cycles, and data-population methods.
• Review and implement the Common Service Data Model.
• Configure integrations and discovery schedules.
• Perform initial data-load reconciliation and iterative accuracy reviews.
• Develop CMDB health KPIs, reports, and dashboards.
• Connect the CMDB with ITSM Change Management, VR, SIR, Application Business Portfolio, and Asset Management.
• Configure forms and work spaces.

Vulnerability Response

• Install and configure Service Now Vulnerability Response.
• Integrate NVD, CWE, CISA KEV, and vulnerability scanners.
• Configure roles, permissions, CI lookup, assignment, grouping, remediation, and risk-calculation rules.
• Configure remediation SLAs, exception processes, notifications, reports, dashboards, and watch topics.
• Enable ITSM Change Management linkage and solution management.

Security Incident Response

• Install and configure Service Now Security Incident Response.
• Integrate Microsoft Azure Sentinel, Palo Alto Networks NGFW, Splunk, and inbound email.
• Configure incident-response processes aligned with NIST and SANS frameworks.
• Configure roles, permissions, assignment and escalation rules, severity calculations, risk scoring, and SLAs.
• Configure threat-intelligence feeds using STIX/TAXII and email sources.
• Develop playbooks, runbook knowledge content, notifications, reports, dashboards, work spaces, and the security incident catalog.
• Document the solution and train staff across all three work streams.