Security Incident Response Engineer (ServiceNow)

About the role

This contract position supports a high‑profile cyber security programme within a Cyber Security Operations Centre. You will design, implement and optimise ServiceNow Security Incident Response (SIR) workflows to improve incident triage, escalation and case management.

Key responsibilities

• Design and configure end‑to‑end Security Incident Response workflows in ServiceNow.
• Develop evidence‑management processes and structured incident lifecycles aligned with NCSC best practices.
• Integrate ServiceNow with SIEM, SOAR and Threat Intelligence platforms.
• Automate security workflows, dashboards and reporting to boost operational efficiency.
• Test, refine and optimise workflows based on stakeholder feedback.

Required profile

• Proven experience delivering ServiceNow Security Incident Response solutions.
• Strong background in ServiceNow Security Operations (SecOps) and ITSM.
• Hands‑on experience linking ServiceNow with security tooling such as SIEM, SOAR and threat feeds.
• Excellent stakeholder management, documentation and knowledge‑transfer abilities.

Required skills

• ServiceNow Security Incident Response (SIR)
• ServiceNow Security Operations (SecOps)
• SIEM integration
• SOAR integration
• Threat Intelligence platform integration
• ITSM (Incident, Change, Problem Management)
• ServiceNow dashboard and reporting configuration