ServiceNow Process Area Lead — VR / SecOps

Role description

• Own the Vulnerability Response and Security Incident Response roadmap through the 90-day window, with build work sitting in a later wave.
• Define the VR remediation workflow model: remediation groups, routing and assignment rules, and remediation task rules.
• Define exception management, including false-positive and deferral questionnaires and POA&M integration.
• Define SIR foundations: assignment groups, escalation paths, priority calculation and response SLAs.
• Sequence VR and SIR against CMDB maturity and confirm scanner and SIEM dependencies.
• Produce a costed, sequenced implementation plan ready to execute in the next delivery wave.
• Act as the security-facing delivery contact for the client security stakeholder.

Required experience

• 5–8 years in security operations tooling, with direct ServiceNow SecOps implementation experience across VR and/or SIR.
• Working knowledge of the vulnerability management lifecycle, remediation targets and exception governance.
• Experience integrating scanners (CrowdStrike, Tenable, Qualys or equivalent) and SIEM platforms into a ticketing workflow.
• Familiarity with federal and state control frameworks — NIST 800-53 and POA&M processes in particular.
• Preferred — uses AI to accelerate security roadmap work: summarizing scan and control data, drafting remediation playbooks, and generating policy and process documentation.
• Applies AI tooling to security content while respecting data handling and classification constraints.
• ServiceNow CIS-VR or CIS-SIR preferred.