ServiceNow SIR Security Incident Response Developer / Engineer
Summary
Builds and maintains ServiceNow's Security Incident Response (SIR) module for a Cyber Defence function — configuring incident intake, triage, SLAs and ACLs, developing Flow Designer automations, and integrating SIEM, SOAR, EDR and ITSM systems via REST APIs and MID Server. Core stack: ServiceNow SIR, JavaScript, Flow Designer, CMDB.
Call : 9987334349 Mail : zeba@contactxindia.com
Role & responsibilities
ServiceNow SIR - Analyst, Acon, Con, AM, Manager -
Location-Mumbai
Immediate joiners/30 days
ServiceNow SIR Security Incident Response Developer / Engineer
Job Description
The ServiceNow Security Incident Response (SIR) Developer / Engineer will implement, configure, and maintain the SIR module to support structured security incident intake, triage, investigation, response, and closure. The role will work with Cyber Defence teams and ServiceNow platform stakeholders to translate operational requirements into maintainable workflows, integrations, and reporting, prioritising out-of-the-box capabilities and controlled customisation.
Responsibilities of this Position
- Gather requirements and configure security incident categories, priorities, assignment rules, states, response tasks, service-level agreements, notifications, forms, and workspaces.
- Develop and maintain Flow Designer flows, sub flows, and actions for incident enrichment, task orchestration, approvals, escalations, and closure; use Business Rules and scripts justified by requirements.
- Integrate SIR with SIEM, SOAR, EDR, threat intelligence, email, and ITSM systems using supported connectors, REST APIs, import sets, transform maps, and MID Server connectivity where required.
- Configure and maintain security incident records, including the sn_si_incident table, related tasks, observables, affected configuration items, and relevant CMDB relationships.
- Implement role-based access controls, ACLs, secure credential management, and appropriate data handling in collaboration with platform and security stakeholders.
- Assess existing customisations and rationalise them against out-of-the-box capabilities, documenting justified exceptions and migration dependencies.
- Conduct functional, integration, regression, and user acceptance testing; manage update sets or approved deployment mechanisms and support upgrades and production troubleshooting.
- Develop operational dashboards and reports, maintain technical documentation and support runbooks, and provide walkthroughs and knowledge transfer to stakeholders.
Requirements, Experience and Qualifications
- Minimum of 3 years of experience in IT security, ServiceNow development, or platform engineering, with hands-on implementation or support experience in ServiceNow SIR.
- Strong understanding of the security incident lifecycle, incident prioritisation, response coordination, observables, and integrations with security monitoring and response tools.
- Proficiency in JavaScript and ServiceNow development concepts, including GlideRecord, Script Includes, Business Rules, Client Scripts, UI Policies, and server-side and client-side scripting.
- Experience with Flow Designer, REST APIs, JSON, import sets, transform maps, authentication, and integration troubleshooting; familiarity with IntegrationHub and MID Server configuration where applicable.
- Knowledge of ServiceNow roles and ACLs, CMDB fundamentals, notifications, reporting, update sets, and controlled application deployment.
- Experience analysing out-of-the-box functionality versus customisation, conducting regression testing, and supporting platform upgrades.
- ServiceNow Certified System Administrator, Certified Application Developer, or Certified Implementation Specialist Security Incident Response certification is preferred.
- Strong troubleshooting, documentation, stakeholder communication, and knowledge-sharing skills.
Preferred candidate profile