ServiceNow Security Engineer

CACl is seeking a ServiceNow Security Engineer to strengthen security across the ServiceNow platform. In this remote role, you will support governance, compliance, and authorization activities, working closely with the ServiceNow Program Manager and the ServiceNow Platform Team to implement and monitor security controls across environments and instances.

You will help ensure alignment with federal security expectations and support ongoing assurance through control validation, evidence gathering, vulnerability management, and participation in security evaluations.

Responsibilities

• Conduct governance, compliance, and assurance activities to ensure the ServiceNow platform aligns with NIST SP 800-53, NIST RMF, and FedRAMP requirements across all environments and instances.
• Define, document, and assess security requirements for ServiceNow implementations, supporting control selection, tailoring, and technical implementation across instance configurations and workflows.
• Build, configure, and enforce ServiceNow security controls including ACLs, RBAC, data encryption (for example, Column-Level Encryption and encryption in transit), IP address restrictions, and security properties aligned with the ServiceNow Hardening Guide.
• Configure and monitor ServiceNow event and security telemetry, maintaining integrations with enterprise SIEM platforms for continuous monitoring, alert correlation, and incident detection.
• Support continuous monitoring for the ServiceNow boundary, including automated evidence gathering, control validation, and recurring assessment activities.
• Manage the POA&M lifecycle for the platform by documenting findings, assigning technical owners, tracking milestones, validating remediation testing, and closing security items.
• Develop and maintain ATO packages for the ServiceNow ecosystem, including SSPs, technical boundary diagrams, control implementation summaries, and supporting evidence artifacts.
• Support internal and external security assessments by coordinating with SCAs, federal auditors, and 3PAOs during formal evaluations.
• Partner with System Owners, ISSOs, ServiceNow platform administrators, developers, and solution architects to implement security controls and remediate audit findings.
• Perform vulnerability management across the ServiceNow platform and integrations, including patch level review, CVE evaluation, remediation prioritization, and tracking resolution timelines.
• Validate and enforce secure configuration baselines using the ServiceNow Instance Security Center (ISC) and security benchmarks such as CIS benchmarks and DISA STIGs.
• Assist with security incident response activities affecting the ServiceNow environment, supporting triage, root-cause investigation, containment, and formal reporting.
• Conduct log analysis across ServiceNow transaction logs, system logs, and administrative audit trails to detect anomalous activity and support federal logging mandates such as OMB M-21-31.
• Oversee ServiceNow user access controls including privileged access management, SSO/MFA configurations, and periodic access recertifications.
• Maintain configuration integrity and asset visibility within the CMDB in accordance with RMF inventory and categorization standards.
• Develop and maintain technical security architecture documentation, standard operating procedures (SOPs), and operational playbooks for platform security administration.
• Formulate and execute project plans for deploying, upgrading, and maintaining ServiceNow security capabilities, modules, and platform updates.
• Perform risk assessments and security impact evaluations for platform change requests such as plugin installations, update sets, custom integrations, and security policy exceptions.
• Support secure development practices for custom ServiceNow applications and catalog items, conducting security reviews of Script Includes, Business Rules, client scripts, and automated test pipelines.
• Use threat intelligence feeds to refine security workflows, identify emerging threats, and strengthen incident containment playbooks.
• Track, aggregate, and report security posture metrics including instance hardening scores, vulnerability remediation timelines, POA&M aging, and audit compliance rates using ServiceNow dashboards and reporting tools.

Requirements

• Ability to obtain Department of Homeland Security (DHS) Entry On Duty (EOD).
• B.A./B.S. or equivalent plus 15 years of relevant experience.
• Experience supporting ServiceNow development.
• Understanding of NIST SP 800-53, RMF, FedRAMP, and federal security control frameworks.
• Hands-on experience supporting ATO packages, SSP development, control implementation statements, and evidence collection.
• Experience performing security assessments, vulnerability analysis, risk assessments, and remediation tracking.

Technologies

• ServiceNow
• NIST SP 800-53
• NIST RMF
• FedRAMP
• SIEM
• ServiceNow Hardening Guide
• Access Control Lists (ACLs)
• Role-Based Access Control (RBAC)
• Column-Level Encryption
• Encryption in transit
• ServiceNow Instance Security Center (ISC)
• CIS benchmarks
• DISA STIGs
• Plan of Action and Milestones (POA&M)
• Authorization to Operate (ATO)
• System Security Plans (SSPs)
• Security Control Assessors (SCAs)
• Third-Party Assessment Organizations (3PAOs)
• SSO/MFA
• ServiceNow Configuration Management Database (CMDB)
• OMB M-21-31

Benefits

• Healthcare
• Wellness
• Financial
• Retirement
• Family support
• Continuing education
• Time off benefits
• Flexible time off
• Robust learning resources

Desired

• CISSP
• CCSP
• CEH
• CySA+
• AWS/Azure security certs

Location: Remote (remote)

Salary: USD 105,100 - 231,100 per yearly

Minimum clearance required to start: None

Time type: Full time

Employee type: Regular

Travel: None

Type of travel: None