TECHNICAL LEAD - ServiceNow

Mandate : CAD and CIS-SIR/SecOps-related CIS-certifications.

• It will be 3 days work from office.
• Regular shifts basis the business need
• As a Consultant / Senior Consultant, you would be expected to perform the following activities:
• Well versed with the application deployment and configuration baselines, and understanding of how the application environment operates in a secure environment and how exceptions are handled during operations.
• Facilitate use of technology-based tools or methodologies to continuously improve the monitoring, management, and reliability of the service.
• Define the architecture and design elements for the implementation of ServiceNow SecOps solution including design data/object models, technical workflow diagrams, access control models, and integration patterns.
• Understand the business requirement and define & document epics, user stories, create UI mock-ups, and have a roll-up-the-sleeves approach to make things happen.
• Facilitate ServiceNow training and support teams on complex system configuration.
• Collaborate with clients to resolve business problems by translating functional requirements into technical solutions.
• Be responsible for end-to-end application design, workflow configurations, and customizations.
• Demonstrate good judgment and a pragmatic approach to delivering a solution that optimizes architecture activities across company needs, business constraints, and technological realities.
•  
• Key Responsibilities (Security Incident Response)
•   Configure and administer ServiceNow Security Incident Response including security incident categories, playbooks, assignment rules, severity/priority models, SLAs, notifications, and response tasking.
•  Design and support incident intake and triage workflows from multiple security sources such as SIEM, SOAR, threat intelligence, email security, EDR/XDR, vulnerability tools, and manual submissions.
•  Integrate and maintain ingestion from security tools into the ServiceNow SIR application and validate data mapping, transformation logic, schedules, deduplication, and error handling.
•  Build and maintain automations using Flow Designer / Integration Hub for enrichment, routing, approvals, escalations, containment support, evidence gathering, and closure activities.
• Configure incident lifecycle processes covering detection, analysis, triage, investigation, containment, eradication, recovery, and post-incident review.
• Partner with SOC, IR, IT Ops, app owners, and resolver groups to coordinate response workflows, manage dependencies, and ensure timely incident remediation.
•  Define and publish dashboards / KPIs in ServiceNow for incident aging, MTTA, MTTR, SLA compliance, incident trends, severity distribution, and analyst workload.
•  Support governance through audit-ready evidence, documentation, runbooks, access controls, and change / release management.
• Enable linkage between security incidents, vulnerable items, change records, problems, and CMDB CIs to improve traceability and operational response.

• Support development of response playbooks and standard operating procedures aligned to enterprise incident management and cyber response requirements.

  Optional Responsibilities (Vulnerability Response)

• Support integration points between Vulnerability Response and SIR, including creation of security incidents from exploited or high-risk vulnerabilities when needed.

  Required Qualifications

• 7- 9 years of ServiceNow experience (Admin/Developer/Platform).
• Hands-on experience implementing or operating ServiceNow Security Incident Response.
• Strong understanding of the security incident management lifecycle and SOC / IR operating processes.
•  Experience with CMDB / asset data concepts and how they affect SIR accuracy, ownership, prioritization, and routing.
•  Working knowledge of integrations (REST / API; MID Server where applicable) and automation (Flow Designer).

•  Understanding incident prioritization, case handling, escalation models, and response coordination across stakeholders.

  Preferred / Nice to Have

• ServiceNow CSA (Mandatory), CAD and CIS-SIR/SecOps-related CIS-certifications.
• Experience integrating ServiceNow with SIEM / SOAR / EDR platforms.

• Scripting (ServiceNow JavaScript), performance tuning, and large-scale data ingestion.

  Core Skills

• ServiceNow SIR, SecOps, CMDB, Flow Designer / Integration Hub, integrations, reporting / dashboards, security incident lifecycle, stakeholder coordination, communication, and presentation.

  Education: 

•   Bachelor s/ Master s degree in information technology or related field

  Location: 

• Bengaluru/Hyderabad/Pune/Chennai/Kolkata/Delhi/Mumbai