Staff Application Security Engineer (ServiceNow Instance Security)

ServiceNow is hiring a Staff Application Security Engineer to secure ServiceNow instances by identifying configuration-driven risks and validating customer-reported security findings. The role develops actionable hardening guidance, supports complex security escalations, and partners across security and engineering teams to reduce instance-level risk.

Responsibilities:

• Assess ServiceNow instance configurations against security baselines and identify misconfigurations that impact confidentiality, integrity, or availability
• Develop and maintain prescriptive instance‑hardening guidance covering authentication, access controls, encryption, logging, monitoring, and operational security
• Translate security requirements and risk into clear, customer‑consumable recommendations that can be implemented by teams with varying security maturity
• Identify recurring misconfiguration patterns and drive systemic improvements (guidance, tooling, checks)
• Triage, validate, and contextualize customer‑reported security findings where instance configuration or deployment patterns are a contributing factor
• Distinguish between product vulnerabilities vs. configuration issues, documenting impact and appropriate remediation paths
• Partner with Product Security, Engineering, and other Security teams to resolve complex or high‑impact findings
• Support escalations and high‑visibility customer interactions as an instance‑security subject‑matter expert

Requirements:

• Experience in leveraging or critically thinking about how to integrate AI into work processes, decision-making, or problem-solving. This may include using AI-powered tools, automating workflows, analyzing AI-driven insights, or exploring AI's potential impact on the function or industry
• 8+ years with strong foundation in application security (vulnerability analysis, secure design principles, threat modeling mindset). Or similar experience with education
• Ability to read, write, and debug code to validate findings and understand security impact
• Experience translating security risk into actionable remediation guidance
• Excellent written and verbal communication skills, especially for customer‑facing or executive‑visible content
• Hands‑on experience with the ServiceNow platform, especially platform security features, configuration, and administration
• Familiarity with SaaS security posture management and misconfiguration risk
• Prior experience supporting customer‑reported security findings, escalations, or external security reviews
• Experience influencing security outcomes without direct authority (cross‑functional collaboration)