ServiceNow SecOps Architect

Job Title: ServiceNow SecOps Architect

Location: Phoenix, AZ - Onsite/WFO 4 Days a Week

Job Type: Contract

Rate: $65/hr

Role Summary

We are seeking an experienced ServiceNow SecOps Architect with deep expertise in Security Incident Response (SIR) and Vulnerability Response (VR) to lead end-to-end architecture, design, development, integration, and governance of ServiceNow SecOps solutions.

Must Have Technical/Functional Skills

12+ years of hands-on ServiceNow development experience

5+ years of hands-on experience implementing ServiceNow SIR and VR

Strong expertise in designing, configuring, and customizing ServiceNow Security Incident Response and Vulnerability Response

ServiceNow Certified Technical Architect (CTA) - Mandatory

Certified Implementation Specialist - Security Incident Response (CIS-SIR)

Strong knowledge of ServiceNow CMDB, Discovery, and ITSM

Experience integrating Qualys, Tenable, Rapid7, Prisma Cloud, or similar vulnerability scanners

Strong knowledge of JavaScript, Glide API, Flow Designer, REST/SOAP

Experience with MID Servers, data sources, and API integrations

Experience with SIEM, SOAR, EDR, and vulnerability management tools

Strong understanding of SOC operations and incident response frameworks such as NIST and SANS

Roles & Responsibilities

Lead end-to-end architecture for ServiceNow SecOps SIR and VR, including data models, scopes, modular design, platform guardrails, and performance best practices

Define SecOps governance standards, architecture principles, and design patterns

Define prioritization models and Risk Score formulas to drive actionable SLAs, dashboards, and remediation processes

Design and develop robust CMDB relationships connecting vulnerabilities to assets, services, and business applications/CIs

Enable service-aware vulnerability remediation, reporting, and risk management

Design and implement bi-directional integration between SIR and ITSM

Integrate enterprise vulnerability scanners such as Tenable, Qualys, Rapid7, Prisma Cloud, and threat intelligence feeds

Tune parsing, de-duplication, normalization, and matching logic for vulnerability data

Optimize Vulnerability Item (VI) normalization, de-duplication, suppression, false-positive handling, and asset-vulnerability correlation at scale

Implement exception workflows for risk acceptance, compensating controls, and deferrals, including risk justification and approvals

Develop automation for vulnerability assignment, remediation tracking, and exception management

Build executive and operational dashboards covering exposure by service, asset tier, business unit, critical vulnerabilities, SLA breaches, and MTTR

Create custom reports and Performance Analytics indicators for vulnerability KPIs and trends

Establish multi-environment strategies across DEV/TEST/PROD

Define and maintain Automated Test Framework (ATF) coverage, upgrade readiness, and platform governance

Design and develop workflows, business rules, client scripts, and integrations supporting the SIR/VR lifecycle

Diverse Lynx LLC is an Equal Employment Opportunity employer. All qualified applicants will receive due consideration for employment without any discrimination. All applicants will be evaluated solely on the basis of their ability, competence and their proven capability to perform the functions outlined in the corresponding role. We promote and support a diverse workforce across all levels in the company.