SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: CAD 109,400 - 191,500 / annual
ServiceNow's Security Organization is seeking a Staff Incident Response Engineer to join the Cyber Investigation, Response & Automation Team in Toronto. This is a senior individual contributor role supporting both commercial and regulated-market customer environments in Canada.
You will monitor and defend ServiceNow's production and regulated environments, correlating security events to identify threats. Key responsibilities include leading incident response efforts affecting customers, responding to account-level threats and attacks, producing forensic and post-incident reports, and developing remediation plans. You will build and maintain incident response playbooks, security standards, and configuration baselines across diverse systems. The role includes serving as an escalation point, participating in 24/7 on-call rotations (including weekends and after-hours), and supporting audits and regulatory investigations. You will also assist with deploying and integrating new security solutions to enhance overall security posture.
This position requires a Government of Canada Reliability Status screening, including identity verification, education verification, criminal record check, and credit check. Candidates must be eligible to obtain and maintain Reliability Status, generally requiring Canadian citizenship or permanent resident status. The role may require security clearance in the future. Employment is contingent upon successful completion and maintenance of required screening.
The role involves rotational and non-standard hours as part of 24/7 operational support.
QUALIFICATIONS & REQUIREMENTS:
- 7 to 10+ years of related experience, or equivalent combination of education and experience
- Deep understanding of Security Operations Center (SOC) and security incident response protocols and procedures
- Extensive experience in incident response, digital forensics, threat hunting, and threat intelligence
- Solid networking foundation, including TCP/IP and core protocols
- Experience with SIEM platforms such as Splunk, plus EDR and SOAR tools
- Ability to analyze event and system logs, perform host and memory forensics (including live response) on Windows, macOS, and/or Linux, and examine malware
- Experience writing internal playbooks, handbooks, and incident response frameworks
- Knowledge of attack vectors, threat tactics, and attacker techniques
- Knowledge of cloud security concepts and experience in AWS, Azure, or GCP
- Coding or scripting experience in one or more general-purpose languages (Python, bash scripting preferred)
- Automation knowledge and experience hardening Linux, Windows, or Mac systems
- Working knowledge of Canadian regulatory requirements for financial services and public sector clients
- Experience working in Canadian regulated markets such as financial services or public sector (highly desirable)
- Experience leveraging or critically thinking about how to integrate AI into work processes, decision-making, or problem-solving (including AI-powered tools, automating workflows, analyzing AI-driven insights)
- Excellent written and verbal communication, including ability to explain incidents to executives and customers
- Willingness to work weekend and after-hours shifts for responding to priority incidents
- Defensive security mindset
- Background working with data logging applications (e.g., Splunk)
- Knowledge of vulnerability scanning tools (Qualys, Nessus)
NICE TO HAVE:
- GCIH, GCFA, GCIA, GMON, GSEC, CISSP, or CEH certifications
- ServiceNow platform knowledge
