CyberSecurity Architect

• ignificant senior-level experience architecting and delivering ServiceNow solutions in enterprise environments.
• Demonstrated hands-on experience implementing or enhancing a risk register, GRC/IRM solution, cybersecurity governance platform, or comparable risk-management workflow.
• Strong understanding of cyber-risk management concepts, including risk identification, inherent/residual risk, risk scoring, risk acceptance, remediation, compensating controls, issue management, and audit evidence.
• Experience designing ServiceNow workflows, approvals, forms, data models, reporting, dashboards, role-based access, notifications, and integrations.
• Ability to translate complex business, compliance, and cybersecurity requirements into scalable technical and process designs.
• Experience working directly with security, compliance, audit, risk, IT operations, and executive stakeholders.
• Strong documentation, communication, facilitation, and stakeholder-management skills.
• Experience leading requirements sessions, solution design reviews, testing, deployment, and knowledge transfer activities.

Preferred qualifications

• ServiceNow Integrated Risk Management (IRM), Governance Risk and Compliance (GRC), Security Operations, Vulnerability Response, or related module experience.
• ServiceNow CSA, CAD, CIS-Risk and Compliance, CIS-Security Operations, or comparable certifications.
• Familiarity with common cybersecurity and risk frameworks such as NIST CSF, NIST 800-53, ISO 27001, CIS Controls, FAIR, or SOC reporting.
• Experience integrating ServiceNow risk workflows with vulnerability-management, security incident, CMDB, asset, control, audit, or project-management data.
• Experience in a large, regulated, transportation, government, financial, or other complex enterprise environment.

Core responsibilities

• Architect and implement an enterprise Cyber Risk Register within ServiceNow.
• Define the end-to-end risk lifecycle, including risk intake, evaluation, prioritization, ownership assignment, remediation planning, approvals, exception handling, closure, and ongoing monitoring.
• Design configurable ServiceNow workflows, forms, data models, roles, notifications, dashboards, and reports that support cyber-risk governance.
• Establish a clear method for documenting risk statements, inherent and residual risk, likelihood, impact, control relationships, treatment plans, due dates, evidence, and remediation status.
• Build executive and operational reporting that provides visibility into open risks, aging items, remediation progress, high-risk exposure, ownership, and audit readiness.
• Partner with Cybersecurity leadership and business stakeholders to gather requirements, facilitate design discussions, resolve process gaps, and drive adoption.
• Ensure the solution is scalable, maintainable, and aligned with ServiceNow platform standards, security controls, and enterprise architecture practices.
• Identify opportunities to integrate the Risk Register with related ServiceNow capabilities and upstream/downstream systems, where appropriate.
• Support testing, deployment planning, user acceptance testing, documentation, training/knowledge transfer, and post-production stabilization.
• Produce architecture diagrams, functional/design specifications, workflow documentation, reporting definitions, and implementation roadmaps.