Staff Product Security Engineer | Application Security

About the position

The ServiceNow Security Organization (SSO) delivers world-class, innovative security solutions to reduce risk and protect the company and our customers. We enable our customers to migrate their most sensitive data and workloads to the cloud, accelerating our business so that we are the most trusted SaaS provider. We create an environment where our employees are proud to work and can make a positive impact.

Responsibilities

• Perform and support security assessments against most modern product features.
• Support code reviews across a mixed language codebase.
• Participate and lead the security research initiative.
• Manage security integration into the SDLC at ServiceNow.
• Partner with developer team and architects to design, implement and improve application security solutions.
• Share experience with authentication and authorization models, modern mobile security methodologies, applied cryptography, and secure-by-design development practices.
• Advocate security awareness and teach secure behavior and methods.
• Implement best-practice security procedures, standards, and guidelines in the application space.
• Work on strategic and highly visible BSIMM activities across the organization.
• Assist in compliance activities such as external audits from customers, regulatory compliance projects, and overall information security reviews.
• Develop tools that make it easier to ship secure code and harder to ship insecure code.
• Lead 'shift-left' initiatives and scale AppSec efforts across the development organizations.

Requirements

• Experience in leveraging or critically thinking about how to integrate AI into work processes, decision-making, or problem-solving.
• Gen AI security Testing methodologies.
• MUST HAVE 8+ years of application/product security experience.
• MUST HAVE 5+ years working with JAVA.
• Ability to break down complex security problems into measurable and solvable pieces.
• Experience running/leading an AppSec program.
• Experience working with large engineering teams and codebases.
• Demonstrated experience and expertise with secure code reviews.
• Identifying and resolving OWASP Top 10 vulnerabilities.
• Threat modeling in an Agile environment.
• Security Verification Standards.
• Cryptography implementations.
• Authentication and authorization schemes.
• Common DAST and SAST tools.
• Strong understanding of web and mobile application security assessment techniques, threat modeling, general software development practices.
• Experience with creating automation in a higher-level scripting language (Python, JavaScript, etc.).
• Ability to perform technical risk assessments, evaluate Static Application Security Testing (SAST) tool results, triage security testing results, and manage security response actions.
• Self-starter, able to work with a mix of technical and non-technical clients.
• Bachelor's OR master's degree in computer science/engineering/information security or equivalent work experience.
• Ability and passion to coach and mentor junior members of the team.

Benefits

• Base pay of $155,800 to $272,700, plus equity (when applicable), variable/incentive compensation and benefits.
• Health plans, including flexible spending accounts.
• 401(k) Plan with company match.
• Employee Stock Purchase Plan (ESPP).
• Matching donations.
• Flexible time away plan.
• Family leave programs.