Product Security Architect (SSDL) at ServiceNow
Work matters. It’s where we spend a third of our lives. And the workplace of the future is going to be a great place. We’re dedicated to bringing that to life for people everywhere. That’s why we put people at the heart of everything we do.
People matter. Our people have a passion for learning, building, and innovating. Whether you’re an engineer, a sales professional, a finance professional, or anything in-between, our roles aim to provide each person with meaningful impact and plenty of space to grow.
Product Security is Shifting Everywhere and holistically improving the maturity of the security program. The Secure Software Development Lifecycle (SSDL) team helps the organization measure and improve security activities. The team leads product threat modeling, measures and recommends BSIMM behaviors, and manages a highly visible security champions program.
As a Product Security Architect on the ServiceNow SSDL team, you will be working on strategic and technical solutions to improve the maturity of the security program. You will be responsible for measuring BSIMM behaviors across multiple business units. You will interact with internal stakeholders, development teams, and security champions to identify areas for improvement.
You will be threat modeling products and services to identify risk and participate in architectural reviews of products in development.
A key part of this position is to ensure the continued success of a large and growing security champions program. You will develop automated processes of continuously measuring training needs and objectives. As a Product Security Engineer, you will help security champions be successful.
What you get to do in this role:
- Work on a wide range of technologies
- Integrate and aggregate data from different systems into consolidated dashboards
- Work on architectural and technical challenges
- Participate in threat modeling activities
- Mentor and collaborate with development teams to adopt secure coding practices
- Work on strategic and highly visible BSIMM activities across the organization
- Be an advocate for security and participate in a security champions program
- Create, measure, and refine metrics used to measure program success
In order to be successful in this role, we need someone who has:
- 10+ years of overall product security experience is required
- 4+ years of experience in threat modeling and threat modeling tools is required
- In-depth knowledge of common web application vulnerabilities (OWASP Top Ten) is required
- Knowledge of static, dynamic, and component analysis security tools is required
- Knowledge of the Software Development Lifecycle (SDLC) is required
- Knowledge of OWASP ASVS, SCVS, and related verification standards is required
- Knowledge of BSIMM, OWASP SAMM, or similar maturity models is required
- Ability to communicate technical concepts to both non-technical business users as well as technical stakeholders is required
- A passion for security is required
ServiceNow is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, national origin, age, disability, gender identity, or veteran status. If you are an individual with a disability and require a reasonable accommodation to complete any part of the application process, or are limited in the ability or unable to access or use this online application process and need an alternative method for applying, you may contact us at [email protected] for assistance.