Staff Incident Response Engineer

🔥 5 minutes ago

🇨🇦 Canada – Remote

💵 $109.4k - $191.5k / year

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

ServiceNow

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 2004

🏢 Enterprise

☁️ SaaS

🤖 Artificial Intelligence

💰 Post-IPO Equity on 2022-12

Enterprise • SaaS • Artificial Intelligence

ServiceNow is a platform that offers AI-powered solutions and automation for businesses to enhance productivity and streamline workflows. Its AI agents are designed to autonomously learn, reason, make decisions, and take action to transform business processes across various domains such as IT, HR, customer service, and app development. The platform enables organizations to integrate data from diverse sources, facilitating business transformation and operational efficiency. Recognized for its leadership in AI IT service management and trusted by a significant portion of the Fortune 500, ServiceNow collaborates with other global leaders like Microsoft and AWS to bring advanced AI capabilities to modernize business operations.

📋 Description

• Monitor tools and systems defending ServiceNow’s production and regulated environments • Correlate seemingly unrelated security events through deductive reasoning • Lead response to incidents affecting customers and track incidents to closure across functional teams • Respond to account-level threats and attacks against customer environments • Produce post-incident reports, forensic reports, and remediation plans • Support audits, compliance requirements, and regulatory investigations • Build and maintain incident response playbooks, handbooks, and cybersecurity standards • Maintain secure configuration baselines for security tools, workstations, servers, and network devices • Analyze vulnerabilities using configuration baseline data • Serve as an escalation point and participate in the on-call rotation, including after-hours and weekends • Assist with deployment, integration, and initial configuration of new or enhanced network and systems security solutions • Improve the organization’s overall security posture

🎯 Requirements

• Successful completion and maintenance of Government of Canada Reliability Status screening • 5 years of verifiable background history, including identity, education, criminal record, and credit checks • Generally requires Canadian citizenship or Canadian permanent resident status • 6+ years related experience or equivalent combination of education and experience • 7 to 10+ years of related experience, or an equivalent mix of education and experience • Experience integrating AI into work processes, decision-making, or problem-solving • Automation knowledge using Python and bash scripting • Experience hardening Linux, Windows, or Mac systems • Experience with data logging applications such as Splunk • Knowledge of vulnerability scanning tools such as Qualys and Nessus • Defensive security mindset • Ability to explain complex issues to executives and customers • Experience working in Canadian regulated markets, such as financial services or public sector, highly desirable • Deep understanding of Security Operations Center and security incident response protocols and procedures • Extensive experience in incident response, digital forensics, threat hunting, and threat intelligence • Solid networking foundation, including TCP/IP and core protocols • Experience with SIEM platforms such as Splunk, plus EDR and SOAR tools • Ability to analyze event and system logs, perform host and memory forensics, including live response, on Windows, macOS, and/or Linux, and examine malware • Experience writing internal playbooks, handbooks, and incident response frameworks • Knowledge of attack vectors, threat tactics, and attacker techniques • Knowledge of cloud security concepts and experience in AWS, Azure, or GCP • Coding or scripting experience in one or more general-purpose languages • Working knowledge of Canadian regulatory requirements for financial services and public sector clients • Excellent written and verbal communication, including the ability to explain incidents to executives and customers • Willingness to work weekend and after-hours shifts • GCIH, GCIH, GCFA, GCIA, GMON, GSEC, CISSP, or CEH certifications are a plus • ServiceNow platform knowledge is a plus

🏖️ Benefits

• Equity (when applicable) • Variable/incentive compensation • Health plans, including flexible spending accounts • ESPP • Matching donations • Flexible time away plan • Family leave programs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume