ServiceNow SecOps SIR - Consultant

Cyber TechRisk - ServiceNow - SecOps – Security Incident Response — Consultant/Senior Consultant
Deloitte’s Cyber Risk Services
help our clients to be secure, vigilant, and resilient in the face of an ever-increasing array of cyber threats and vulnerabilities. Our Cyber Risk practice helps organizations with the management of information and technology risks by delivering end-to-end solutions using proven methodologies and tools in a consistent manner. Our services help organizations address, in a timely manner, pervasive issues such as identity theft, data security breaches, data leakage, cyber security, and system outages across organizations of various sizes and industries with the goal of enabling ongoing, secure, and reliable operations across the enterprise.
We are seeking an experienced ServiceNow Developer / Consultant with strong hands-on expertise in the Security Incident Response (SIR) module. The ideal candidate will have 3+ years of ServiceNow platform development experience, including at least 2 years focused specifically on implementing and managing Security Incident Response solutions. This role will be responsible for configuring, customizing, integrating, and automating the ServiceNow SIR lifecycle to support incident intake, triage, investigation, containment, remediation, and reporting.
Work you will do
As a
Consultant / Senior Consultant
, you would be expected to perform the following activities:
Well versed with the application deployment and configuration baselines, and understanding of how the application environment operates in a secure environment and how exceptions are handled during operations.
Facilitate use of technology-based tools or methodologies to continuously improve the monitoring, management, and reliability of the service.
Define the architecture and design elements for the implementation of
ServiceNow SecOps solution
including design data/object models, technical workflow diagrams, access control models, and integration patterns.
Understand the business requirement and define & document epics, user stories, create UI mock-ups, and have a roll-up-the-sleeves approach to make things happen.
Facilitate ServiceNow training and support teams on complex system configuration.
Collaborate with clients to resolve business problems by translating functional requirements into technical solutions.
Be responsible for end-to-end application design, workflow configurations, and customizations.
Demonstrate good judgment and a pragmatic approach to delivering a solution that optimizes architecture activities across company needs, business constraints, and technological realities.
Key Responsibilities (Security Incident Response)
Configure and administer ServiceNow Security Incident Response including security incident categories, playbooks, assignment rules, severity/priority models, SLAs, notifications, and response tasking.
Design and support incident intake and triage workflows from multiple security sources such as SIEM, SOAR, threat intelligence, email security, EDR/XDR, vulnerability tools, and manual submissions.
Integrate and maintain ingestion from security tools into the ServiceNow SIR application and validate data mapping, transformation logic, schedules, deduplication, and error handling.
Build and maintain automations using Flow Designer / Integration Hub for enrichment, routing, approvals, escalations, containment support, evidence gathering, and closure activities.
Configure incident lifecycle processes covering detection, analysis, triage, investigation, containment, eradication, recovery, and post-incident review.
Partner with SOC, IR, IT Ops, app owners, and resolver groups to coordinate response workflows, manage dependencies, and ensure timely incident remediation.
Define and publish dashboards / KPIs in ServiceNow for incident aging, MTTA, MTTR, SLA compliance, incident trends, severity distribution, and analyst workload.
Support governance through audit-ready evidence, documentation, runbooks, access controls, and change / release management.
Enable linkage between security incidents, vulnerable items, change records, problems, and CMDB CIs to improve traceability and operational response.
Support development of response playbooks and standard operating procedures aligned to enterprise incident management and cyber response requirements.
Optional Responsibilities (Vulnerability Response)
Support integration points between Vulnerability Response and SIR, including creation of security incidents from exploited or high-risk vulnerabilities when needed.
Required Qualifications
3-10 years of ServiceNow experience (Admin/Developer/Platform).
Hands-on experience implementing or operating
ServiceNow Security Incident Response
.
Strong understanding of the security incident management lifecycle and SOC / IR operating processes.
Experience with CMDB / asset data concepts and how they affect SIR accuracy, ownership, prioritization, and routing.
Working knowledge of integrations (REST / API; MID Server where applicable) and automation (Flow Designer).
Understanding incident prioritization, case handling, escalation models, and response coordination across stakeholders.
Preferred / Nice to Have
ServiceNow
CSA (Mandatory), CAD
and CIS-SIR/SecOps-related
CIS
-certifications.
Experience integrating ServiceNow with SIEM / SOAR / EDR platforms.
Scripting (ServiceNow JavaScript), performance tuning, and large-scale data ingestion.
Core Skills
ServiceNow SIR, SecOps, CMDB, Flow Designer / Integration Hub, integrations, reporting / dashboards, security incident lifecycle, stakeholder coordination, communication, and presentation.
Education:
•
Bachelor’s/ Master’s degree in information technology or related field
Location:
Bengaluru/Hyderabad/Pune/Chennai/Kolkata/Delhi/Mumbai