Staff Incident Response Engineer Canada

Protect ServiceNow production environments in Canada through incident response, threat hunting, and security automation expertise. Support commercial and regulated-market customers.

This Staff Incident Response Engineer serves Cyber Investigation, Response & Automation within the ServiceNow Security Organization. The role monitors defensive tools, correlates events, and leads customer incident response. It requires digital forensics, threat intelligence, SIEM, and cloud security knowledge.

Key Responsibilities:

• Monitor defensive tools across production and regulated environments
• Lead customer incident response and track incidents to closure
• Produce forensic reports, post-incident reports, and remediation plans
• Maintain playbooks, handbooks, standards, and configuration baselines
• Support audits, investigations, deployments, and on-call escalation

Requirements:

• Seven to ten or more years related experience
• Incident response, threat hunting, and digital forensics expertise
• Splunk, EDR, SOAR, and vulnerability scanning experience
• Python or bash scripting and systems hardening knowledge
• Eligibility for Government of Canada Reliability Status screening

Bring defensive security leadership, forensic analysis, and automation skills to ServiceNow’s Canadian incident response team.