Cyber ServiceNow SecOps/ SIR - Business Process Consultant

In this role, you help clients strengthen cybersecurity operations by shaping ServiceNow-based processes and integrations. You'll work with SOC, IR, and threat intel teams to map and improve incident response workflows, data flows, and tool integrations. You'll translate requirements into epics and stories, design SIR configurations, and support testing and training. This is a hands-on, cross-functional role with opportunities to lead initiatives and drive secure, scalable incident response capabilities.

• discretionary annual incentive program

• Facilitate workshops and interviews with SOC/IR/threat intel to document current and future-state processes
• Map incident lifecycles and data to ServiceNow SIR capabilities and data models; identify gaps
• Develop epics, user stories, RACI, data flows, and integration needs for SIEM, EDR, TISC, and CMDB
• Support SIR workspace design and configuration, incident forms, escalation rules, playbooks, dashboards, and access controls
• Produce test scenarios, training materials, release notes; manage backlog, sprint prep, UAT, defect triage, cutover and risk tracking

• Bachelor's degree in listed fields
• ServiceNow CSA and 2+ years supporting ServiceNow implementations in client-facing consulting
• 2+ years gathering requirements, facilitating workshops, and documenting flows or user stories
• 2+ years designing, configuring, or implementing ServiceNow SIR
• Experience supporting SOC and incident response processes
• Ability to travel 50%
• Limited immigration sponsorship may be available

• Independent work style with ability to collaborate
• Effective written and verbal communication
• Meticulous attention to detail
• ServiceNow Security Incident Response (SIR) design and configuration
• Workshop facilitation and requirements gathering
• SIR data models, incident forms, states, and notifications