Staff Product Security Engineer - PSIRT

The core responsibilities for the job include the following:

Lead Through Significant Security Events:

• Demonstrate technical and organizational leadership during these events, bringing structure and clear decision-making under pressure.
• Partner with incident commanders, business information security leadership, engineering, and customer-facing teams to maintain clear ownership, workstream prioritization, and hand-offs during these events.

Reduce Exposure Window:

• Drive coordinated response across affected releases, balancing risk and remediation feasibility.
• Leverage an understanding of product development cycles and engineering/product partnerships to move fixes through the release pipeline without stalling on organizational boundaries.
• Verify fix completeness and guard against incomplete mitigations before release.

CVE and Coordinated Disclosure Process:

• Contributed to ServiceNow's CVE disclosure process for incidents you own; CVE assignment, scoring, advisory content, and publication timing.
• Conduct technical accuracy reviews of external advisories, researcher write-ups, and joint disclosure content to ensure correctness before publication.

Pursue After-Action Outcomes and Continuous Improvement:

• Author root cause analyses and drive lessons learned to closure following product security incidents.
• Participate in retrospectives following significant product security events, translating findings into concrete process and technical improvements.
• Contribute to partner teams tracking product security risk themes and trends across the portfolio.
• Contribute to SDLC improvement areas, feeding incident learnings upstream into secure development practices.

Requirements:

• Experience in leveraging or critically thinking about how to integrate AI into work processes, decision-making, or problem-solving. This may include using AI-powered tools, automating workflows, analyzing AI-driven insights, or exploring AI's potential impact on the function or industry.
• Minimum 8 years of related experience with a bachelor's degree; or 6 years with a master's degree; or a PhD with 3 years of experience; or equivalent experience.
• Minimum 4 years of auditing source code for security vulnerabilities.
• Demonstrated leadership during significant security events or major incidents, with willingness to participate in on-call.
• Ability to read and comprehend Java and JavaScript code.
• Strong understanding of common Java and JavaScript vulnerabilities.
• Proficiency in scripting in both Python and JavaScript for data gathering, processing, and visualization.
• Development of proof-of-concept exploits for web application vulnerabilities.
• Written and verbal communication of complex security risks clearly to both technical teams and leadership.
• Experience with leading fix implementation and release coordination across engineering, product, and test/release teams.
• Proficiency in deep-dive product security investigations and root-cause analysis spanning design, code, configuration, and operational layers.
• Exploit analysis and proof-of-concept development that distinguishes real exploitability from theoretical risk.
• Familiarity with SDLC integration, CI/CD pipelines, SaaS threat models, and secure development practices.

Preferred Qualifications:

• Experience in a PSIRT or similar function for a major software or SaaS platform.
• Recognized expertise in product security incident response, vulnerability research, or application security within a software or SaaS environment.
• Experience conducting vulnerability assessments on the ServiceNow platform.
• Experience with emerging threats: AI-specific attack vectors, software supply chain security, and SDLC tooling security.
• Experience with cloud infrastructure (AWS, Azure, GCP) and containerized environments.
• Relevant security certifications (e. g., OSWE) or demonstrated equivalent expertise.

Skills

AppSec, Java, JavaScript, PSIRT, Python, application security, code review, incident response, product security, security, source code, vulnerability management