Opportunity at
ServiceNowStaff Product Security Engineer, PSIRT
This full-time, on-site Staff Product Security Engineer role sits on ServiceNow's Product Security Incident Response Team (PSIRT) in Hyderabad. The engineer acts as a senior technical…
Career Tools
About This Role
This full-time, on-site Staff Product Security Engineer role sits on ServiceNow's Product Security Incident Response Team (PSIRT) in Hyderabad. The engineer acts as a senior technical authority on post-release vulnerabilities, leads deep-dive investigations and coordinates fixes across engineering, product and release teams during significant security events. The job also covers CVE disclosure work, technical review of advisories, root-cause analyses and feeding lessons into secure development. The posted coverage includes early-morning…
Job Description
This full-time, on-site Staff Product Security Engineer role sits on ServiceNow's Product Security Incident Response Team (PSIRT) in Hyderabad. The engineer acts as a senior technical authority on post-release vulnerabilities, leads deep-dive investigations and coordinates fixes across engineering, product and release teams during significant security events.
The job also covers CVE disclosure work, technical review of advisories, root-cause analyses and feeding lessons into secure development. The posted coverage includes early-morning and weekend windows in UTC, and on-call participation is expected.
Responsibilities
- Lead through significant security events with structured decisions and clear ownership
- Coordinate fix delivery across affected releases and verify that mitigations are complete
- Contribute to CVE assignment and scoring, and review advisories for technical accuracy
- Write root-cause analyses and drive lessons learned into secure development practice
Requirements
- Experience auditing source code for security vulnerabilities for at least four years
- Ability to read and understand Java and JavaScript code, with knowledge of common flaws in both
- Willingness to participate in on-call and lead during major incidents
Qualifications
- Eight years of related experience with a bachelor's degree, six with a master's, or three after a PhD
- Proficiency in Python and JavaScript scripting and in developing proof-of-concept exploits for web vulnerabilities
- Experience in a PSIRT or similar product security function is preferred
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Where is the job?
The listing places the role in Hyderabad, India, as on-site work.
Is on-call work expected?
Yes, the posting asks for willingness to participate in on-call and lead during significant incidents.
What experience is needed?
The posting asks for at least four years of source code security auditing, with overall experience scaled to education.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.