Senior Security Engineer, Security Operations

The Moveworks Security team at ServiceNow is seeking a Security Automation Disruptor to automate security operations and enhance incident response through AI-driven workflows. The role involves designing autonomous security processes, leveraging AI and cloud technologies, and working closely with red teams to improve security defenses.

Location: Remote (US)

Responsibilities

• Design and implement end-to-end automation for the incident response lifecycle (Detection, Triage, Containment, Recovery).
• Build and tune high-fidelity detections in SIEM, EDR, and AI SOC platforms.
• Leverage LLMs, Prompt Engineering, and MCP servers to build scalable security workflows.
• Detect and disrupt internal red team activities, working closely with the red team to identify vulnerabilities.
• Design and execute automated tests to validate detections and playbooks.
• Gather data to make informed decisions in complex situations.
• Support active incidents as an incident responder, using each event to improve automation.

Requirements

• U.S. Citizenship required.
• 1–5 years of experience in Security Operations or Security Engineering.
• Proficiency in Python, working with APIs, webhooks, and Git.