Staff Security Engineer, ServiceNow
ecurity Operations, Moveworks
Cloud-based digital workflows for enterprises
Be an early applicant
Cloud-based digital workflows for enterprises
1001+ employees
Be an early applicant
1001+ employees
Company mission
To transform IT to revolutionize the enterprise.
Role
Who you are
- This is a role for a visionary engineer who wants to push the boundaries of what agentic AI can achieve in enterprise defense
- U.S. Citizenship Required: (Must meet strict compliance/FedRAMP criteria)
- Experience: 8–10 years of experience in Security Operations, Systems Engineering, or DevSecOps (Minimum 5 years of highly relevant engineering experience required)
- Cross-Functional Mastery: 3–5 years of proven track record working closely across multidisciplinary teams including Cloud Infrastructure, DevOps, DevSecOps, Compliance, and IT. Bonus points for direct collaboration experience with Product Security or Data Security teams
- AI & Agentic Fluency: Deep familiarity with modern LLM agent frameworks, including active research into their application, performance trade-offs, and behavioral guardrails. You know how to deeply integrate LLMs, orchestrate custom MCP servers, and build autonomous technical workflows
- Automation Engineering: High proficiency in Python and software engineering principles. You have extensive past experience with traditional workflow engines and legacy SOAR tooling, giving you the context needed to successfully replace them with AI-native alternatives
- Cloud & Infrastructure Depth: Strong, hands-on architectural familiarity with AWS security ecosystems (IAM, CloudTrail, GuardDuty) and containerized environments (Kubernetes/EKS)
- FedRAMP & Trust Awareness: While an engineer first, you possess the communication skills and security compliance maturity to translate framework controls into automated, code-driven evidence generation pipelines
- Team & Collaboration Dynamics: A high-autonomy, high-collaboration mindset. You thrive in a lean, elite, fast-moving team environment where you independently drive massive technical impact while mentoring and leveling up surrounding engineers
What the job involves
- The Moveworks Security team at ServiceNow is not looking for a traditional SOC analyst to watch a dashboard. We are looking for a Staff Agentic Security Engineer. Our ultimate goal is to automate the SOC out of existence through autonomous systems
- At the IC4 level, you will not just execute workflows; you will define the architectural framework for our AI-driven defense
- You will treat the incident response lifecycle as an advanced engineering problem—experimenting with, designing, and orchestrating complex, multi-agent frameworks and Model Context Protocol (MCP) systems that handle proactive threat hunting, triage, and remediation at machine speed
- Building and AI Orchestration: Move beyond basic tool configuration to build, code, design and research advanced, framework-level approaches for chaining MCP servers and AI agents. You will optimize agentic networks for maximum performance, multi-step reasoning accuracy, and deterministic outcomes in high-stress security scenarios
- Proactive Threat Hunting Program: Architect and scale a proactive threat hunting program from scratch. You will leverage custom agents, MCP capabilities, and security tooling to proactively discover complex vulnerabilities, configuration drift, and hidden threats across the infrastructure network
- Advanced Purple Team Synergies: Forge a cutting-edge feedback loop between the Blue Team and our internally developed AI Red Team Agent. You will seamlessly bridge automated offense and defense, turning threat hunting insights into self-healing infrastructure
- Cross-Functional Influence & Leadership: Act as a strategic engineering partner across IT, Security Engineering, DevOps, DevSecOps, Compliance, Cloud, and Infrastructure teams to ensure corporate systems are natively "automation-ready."
- E2E IR Automation Architecture: Own the overarching engineering roadmap for the end-to-end incident response lifecycle (Detection → Triage → Containment → Recovery), replacing traditional SOAR workflows with resilient, agentic orchestration
- Incident Commander Escalation: Serve as a high-tier technical escalation point for active, complex incidents. Use every incident as an adversarial data point to design superior automated immune responses
- Validate the Defense: Design, execute, and validate automated simulation testing to systematically prove that agentic workflows and detection pipelines trigger reliably against real-world attack behaviors
Our take
ServiceNow provides cloud-based solutions that define, structure, manage, and automate services for enterprise operations, transforming old, manual ways of working into modern digital workflows. The company was founded in 2004 with a vision to build a cloud-based platform that would enable regular people to route work effectively through the enterprise.
Much as Salesforce enables a company to manage its external clients by keeping a record of all contacts and interactions, ServiceNow promises an internal system to meet the needs of employees. It has succeeded in claiming half the market, setting itself apart from legacy IT service-management software players like BMC Software, Hewlett Packard Enterprise, Cherwell Software and CA Technologies.
The company's success comes from two product traits: simplicity and customisability. ServiceNow's IT tools don't require the IT department to set them up. Once running, they offer a single collection centre for requests, data points and checklists, all of which can in turn be analysed by algorithms to predict needs, flag concerns and measure efficiency.
The company has more than 7,700 customers, including 85% of the Fortune 500 list of the United States' largest corporations. ServiceNow now looks to increase its revenue threefold in the upcoming years and has entered into a 5-year partnership plan with Visa, beginning with the launch of a Visa-integrated dispute resolution solution for issuers. The company is prioritising organic growth over mergers and acquisitions, with a target revenue of $15B, something which its Visa partnership will no doubt aid in achieving.
Freddie
Company Specialist at Welcome to the Jungle
Insights
16% employee growth in 12 months
Company
Funding (last 2 of 6 rounds)
Mar 2012
$11m
GROWTH EQUITY VC
Feb 2012
$17.9m
GROWTH EQUITY VC
Total funding: $83.8m
Company benefits
- Generous family leave
- Matched donations
- Annual learning stipends
- Flexible PTO
- Competitive retirement plan
- Paid volunteer time
Company HQ
Santa Clara, CA
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 55 more jobs at ServiceNow