ServiceNow Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a ServiceNow Security Engineer based in the United States.
Join a security-focused engineering team responsible for protecting and strengthening enterprise ServiceNow environments supporting critical government missions.
In this role, you will lead platform security initiatives, ensure regulatory compliance, and implement robust controls aligned with federal cybersecurity frameworks.
You will apply your expertise in NIST Risk Management Framework (RMF), NIST SP 800-53, and FedRAMP to support secure platform configurations and authorization processes.
Working closely with platform administrators, developers, architects, and security stakeholders, you will drive vulnerability remediation, continuous monitoring, and risk management activities.
You will also oversee security documentation, audit readiness, identity and access governance, and the development of secure ServiceNow applications.
This fully remote, full-time opportunity offers the chance to influence security strategy and improve the resilience of complex enterprise technology environments.
Ideal for an experienced security professional, this position combines hands-on technical implementation, regulatory assurance, and cross-functional leadership.
\Ensure ServiceNow environments and instances comply with NIST SP 800-53, the NIST Risk Management Framework (RMF), FedRAMP, and applicable federal cybersecurity requirements.
Security Requirements and Control Implementation:
Define, document, assess, and implement security requirements for ServiceNow solutions, including control selection, tailoring, configuration, and workflow integration.
Platform Hardening:
Configure and enforce security controls, including Access Control Lists (ACLs), Role-Based Access Control (RBAC), encryption at rest and in transit, IP restrictions, and security settings aligned with ServiceNow hardening guidance.
Continuous Monitoring:
Support continuous monitoring activities in accordance with NIST CA-7, including automated evidence collection, recurring control validation, security assessments, and ongoing compliance verification.
Configure and monitor platform security telemetry and event integrations with enterprise SIEM solutions to support alert correlation, threat detection, and incident investigation.
Develop and maintain Authorization to Operate (ATO) documentation, System Security Plans (SSPs), technical boundary diagrams, control implementation statements, and supporting evidence packages.
Risk and Remediation Management:
Manage Plans of Action and Milestones (POA&Ms), document findings, assign remediation owners, monitor milestones, validate corrective actions, and close security issues.
Review platform patch levels, analyze Common Vulnerabilities and Exposures (CVEs), prioritize remediation activities, and track resolution timelines across ServiceNow environments and integrations.
Configuration and Baseline Compliance:
Validate secure configuration baselines using ServiceNow Instance Security Center (ISC), CIS benchmarks, DISA Security Technical Implementation Guides (STIGs), and other applicable standards.
Manage user access controls, privileged access, single sign-on (SSO), multifactor authentication (MFA), and periodic access recertification in alignment with federal access-control requirements.
Incident Response and Security Operations:
Support security incident triage, root-cause analysis, containment, investigation, and reporting for incidents affecting the ServiceNow platform.
Logging and Audit Analysis:
Review transaction logs, system logs, and administrative audit trails to identify suspicious activity and maintain compliance with federal logging requirements, including OMB M-21-31.
Asset and Configuration Management:
Maintain the integrity and visibility of assets and configuration records in the ServiceNow Configuration Management Database (CMDB), supporting accurate inventory and RMF categorization.
Review custom ServiceNow applications, catalog items, Script Includes, Business Rules, client scripts, and automated testing pipelines to identify vulnerabilities and promote secure development practices.
Risk Assessments and Change Management:
Evaluate security risks and operational impacts associated with change requests, plugin installations, update sets, custom integrations, and security policy exceptions.
Threat Intelligence and Detection:
Use threat intelligence to improve security workflows, identify emerging threats, strengthen detection capabilities, and refine incident containment procedures.
Project Delivery and Platform Modernization:
Plan and coordinate the deployment, upgrading, maintenance, and rollout of ServiceNow security capabilities, modules, and platform updates.
Develop and maintain dashboards and reports covering security posture, hardening scores, vulnerability remediation timelines, POA&M aging, and audit compliance performance.
Partner with system owners, Information System Security Officers (ISSOs), ServiceNow administrators, developers, and solution architects to implement security controls, resolve audit findings, and maintain a secure operating environment.
Create and maintain security architecture documentation, standard operating procedures, operational playbooks, and other technical guidance for platform security administration.
Bachelors degree or equivalent qualifications, combined with at least 15 years of relevant professional experience.
ServiceNow Development:
Demonstrated experience supporting ServiceNow development and familiarity with platform architecture, configuration, application security, and integrations.
Federal Cybersecurity Frameworks:
Strong understanding of NIST SP 800-53, the NIST Risk Management Framework, FedRAMP, and federal security control requirements.
Hands-on experience supporting Authorization to Operate packages, developing System Security Plans, documenting control implementations, and collecting assessment evidence.
Experience conducting security assessments, vulnerability analysis, risk evaluations, control validation, and remediation tracking.
Cloud and Platform Security:
Knowledge of enterprise security principles, cloud environments, secure configurations, encryption, identity and access management, and continuous monitoring.
Vulnerability and Risk Management:
ServiceNow Security Controls:
Familiarity with ACLs, RBAC, the ServiceNow Instance Security Center, secure application development, and platform hardening practices.
Audit and Regulatory Readiness:
Security Clearance Eligibility:
Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified Ethical Hacker (CEH), CompTIA Cybersecurity Analyst (CySA+), or relevant AWS or Microsoft Azure security certifications.
Commitment to security best practices, regulatory compliance, confidentiality, accountability, and the protection of sensitive government information.
Ability to work remotely on a full-time basis while collaborating effectively with distributed technical and security teams.
105,100–$231,100 , depending on geographic location, relevant experience, education, certifications, applicable government contract labor categories, and contract wage rates.
Remote Work:
Fully remote work arrangement within the United States, with no travel required for this position.
Access to healthcare coverage options designed to support employee health and well-being.
Retirement and Financial Benefits:
Access to retirement plans and other financial benefits, subject to applicable plan terms.
Benefits and resources designed to help employees manage family responsibilities and personal needs.
Access to time-off benefits and flexible time-off arrangements, subject to applicable policies and eligibility.
Learning and development opportunities to expand cybersecurity knowledge, strengthen technical capabilities, and support career growth.
The opportunity to contribute to federal cybersecurity objectives and protect mission-critical technology environments.
Work alongside experienced security professionals, ServiceNow specialists, architects, developers, and program stakeholders.
Opportunities to deepen expertise in ServiceNow security, federal compliance, cloud security, vulnerability management, and DevSecOps practices.
\AI-powered matching process
to ensure your application is reviewed quickly, objectively, and fairly against the roles core requirements. Data Privacy Notice:
By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR).