Staff Applied Security Engineer

ServiceNow’s ACES team is seeking a Staff Applied Security Engineer to help highly regulated customers adopt the ServiceNow platform and associated AI, cloud, and emerging technologies with secure outcomes. In this onsite role in Santa Clara, CA, you will collaborate across security, engineering, and executive stakeholders while delivering hands-on security architecture work, from threat modeling to customer-facing security reference architectures.

What you’ll do

• Partner directly with customer security, architecture, engineering, risk, compliance, and executive stakeholders to address security concerns and accelerate platform adoption.
• Develop customer-facing security reference architectures that clearly explain trust boundaries, data flows, identity models, encryption controls, and shared responsibility models.
• Conduct threat modeling for ServiceNow products, AI services, integrations, and customer deployment architectures.
• Analyze security architectures across cloud-native and distributed systems environments.
• Lead security deep dives covering networking, identity, encryption, data protection, application security, and AI security controls.
• Evaluate customer security requirements and map them to ServiceNow platform capabilities and industry best practices.
• Coordinate with Product Management, Engineering, Product Security, and Architecture teams to identify capability gaps and advocate for customer-driven improvements.
• Create scalable artifacts such as architecture patterns, deployment guides, implementation accelerators, technical whitepapers, detection content, and security design documentation.
• Assess integrations involving AI, cloud services, APIs, Kubernetes environments, data platforms, and third-party technologies.
• Define secure deployment patterns for emerging AI capabilities including agents, model integrations, governance controls, and data protection mechanisms.
• Represent ServiceNow security architecture and best practices during customer workshops, architecture reviews, executive briefings, and security assessments.

What you bring

• 5+ years of hands-on experience in security engineering, security architecture, cloud security, application security, product security, or related disciplines.
• Strong foundation in identity and access management, authentication and authorization, network security, cryptography and key management, data protection and privacy, security monitoring and incident response, and secure software development.
• Experience assessing and securing cloud-native architectures.
• Strong knowledge of Kubernetes, container security, service-to-service communications, workload isolation, and modern application deployment patterns.
• Experience with one or more major cloud providers: AWS, Microsoft Azure, or Google Cloud Platform (GCP).
• Experience running threat modeling using frameworks such as STRIDE, ATT&CK, PASTA, or similar methodologies.
• Ability to build and communicate architecture diagrams showing data flows, trust boundaries, security controls, and deployment models.
• Strong written and verbal communication skills, including the ability to engage audiences from engineers to CISOs.
• Experience presenting security recommendations and architectural guidance to customers and executive stakeholders.
• A curious mindset and willingness to continuously learn emerging technologies including AI, cloud-native platforms, and modern security architectures.

Technologies

• Kubernetes
• Amazon Web Services (AWS)
• Microsoft Azure
• Google Cloud Platform (GCP)
• STRIDE
• ATT&CK
• PASTA
• JavaScript

Preferred qualifications

• Experience supporting Fortune 500 or highly regulated enterprise customers.
• Experience with financial services, healthcare, or public sector organizations.
• Knowledge of AI security, AI governance, model risk management, prompt injection risks, agentic systems, and emerging AI threats.
• Experience using AI technologies to improve security operations, threat detection, security analysis, or engineering productivity.
• Familiarity with JavaScript, scripting, or automation development.
• Experience with the ServiceNow platform.
• Experience developing security reference architectures, implementation patterns, or technical guidance consumed at scale.
• Industry certifications such as CISSP, CCSP, AWS Security Specialty, Azure Security Engineer, GSEC, GIAC, OSCP, or equivalent.

Work model and accommodations

• Work personas may be flexible, remote, or required in office depending on assigned work location.
• ServiceNow may confirm distance between your primary residence and the closest ServiceNow office using a third-party service to determine work persona eligibility.
• If you require a reasonable accommodation during the application process, contact [email protected] for assistance.

Export control regulations

• For positions requiring access to controlled technology subject to export control regulations (including the U.S. Export Administration Regulations (EAR)), ServiceNow may be required to obtain export control approval for certain individuals.
• Employment is contingent upon ServiceNow obtaining any export license or other required approval.