Staff Information Security Analyst

The ServiceNow Security Organization (SSO) delivers security solutions to reduce risk and protect the company and its customers. The Global Security Support Center (GSSC) is a team of security professionals who strengthen internal and external security posture, serve as a key interface with customers on security-related matters, and provide external and internal facing security support.

Responsibilities

Represent the security organization in customer-facing security incidents, cases, security findings, tasks, questions and calls related to security and privacy; Own, triage, investigate and respond to security matters of the ServiceNow platform; Act as the primary point of contact for security-related matters, supporting internal and external stakeholders; Facilitate the efficient workflow/triage of security-related incidents/cases; Build and maintain customer trust and confidence; Manage customer outreach communications on security and escalation handling; Understand and deliver capability maturity models to fine-tune security processes; Create and enhance documentation and processes to strengthen security maturity; Develop and deliver training/enablement programs on security; Develop AI solutions for automating repetitive activities and design new solutions leveraging AI; Work with Legal on security/privacy-related matters and with a global team across time zones; Provide support as a responsible resource for the on-call rotation (weekends, public holidays, and after hours) as rostered

Requirements

Minimum of 8 years of professional experience in information security or application security roles, or similar experience with education; Candidate must be eligible to obtain and hold a reliability status in Canada; Solid understanding of cloud computing models and major hyperscaler cloud models; Hands-on experience with security tools and technologies, including SIEM solutions, logging tools, load balancers, firewalls, WAFs, IDS/IPS, vulnerability management platforms, encryption techniques; Basic to Intermediate-level programming knowledge in Java/JavaScript; Intermediate to Advanced proficiency in web proxy tools for security testing and assessments; In-depth understanding of web application vulnerabilities (e.g., OWASP Top Ten) and corresponding mitigation strategies; Ability to clearly explain security risks to non-technical stakeholders; Good knowledge of compliance and regulatory frameworks including NIST, CIS, GDPR, HIPAA, PCI DSS, ISO standards; Experience working with AI technologies and designing AI-based solutions; Strong analytical and problem-solving capabilities; Excellent verbal and written communication skills; Ability to thrive in a team-oriented, collaborative environment, working in a follow-the-sun model

Nice to have

Preferred certifications (two or more): ServiceNow Certified System Administrator (CSA); Azure AI Fundamentals; AWS Certified AI Practitioner; Offensive Security Web Assessor (OSWA); GIAC Web Application Penetration Tester (GWAPT); GIAC Security Essentials Certification (GSEC); GIAC Certified Incident Handler (GCIH); CISSP; CISM; Preferred Bachelor's degree in computer science or information security or relevant information security experience; Preferred hands-on experience with web-based vulnerability exploitation

Benefits

Health plans, including flexible spending accounts; ESPP; Matching donations; Flexible time away plan; Family leave programs; Equity (when applicable); Variable/incentive compensation