Location: Rockville, MD (Primarily Onsite)
Position Summary
The SecDevOps / ServiceNow SME supports NIAID SIRT cybersecurity operations through the maintenance, administration, and enhancement of ServiceNow Vulnerability Response workflows, cybersecurity tool integrations, vulnerability-management automation, and related SecDevOps activities. The position also provides limited support to SOC security-alert review and triage as operational needs permit.
Primary Responsibilities
ServiceNow Vulnerability Response / SecDevOps
- Maintain and support ServiceNow Vulnerability Response (VR) operations.
- Monitor SecOps health dashboards and scheduled jobs.
- Support and troubleshoot Tenable and Invicti integrations with ServiceNow VR.
- Reclassify discovered items and address vulnerability-record data issues.
- Maintain and update vulnerability assignment rules.
- Identify appropriate support groups and support applicable CMDB updates.
- Maintain and improve automated routing of vulnerabilities to responsible support teams.
- Troubleshoot VR workflow, integration, and data-quality issues.
Integration & Enhancement
- Support development, testing, and implementation of cybersecurity integrations and workflow enhancements.
- Support ongoing initiatives such as GitHub Advanced Security integration and SCCM Patch Orchestration.
- Assist with ServiceNow/CMDB integration and data-quality improvements.
- Coordinate with NIH/ServiceNow administrators when required changes exceed SIRT permissions or access.
SOC Support
- Provide secondary support for review and initial triage of Splunk security alerts as workload and operational priorities permit.
- Assist with gathering available security context needed to evaluate alerts.
- Escalate potentially significant security activity to the Cybersecurity Analyst/SOC Lead for further investigation.
- Provide feedback on repetitive or noisy alerts that may benefit from tuning or automation.
Documentation & Continuity
Maintain technical documentation and operational procedures for supported workflows and integrations.
Support knowledge transfer and cross-training within SIRT to reduce single-person dependencies.
Desired Experience
- ServiceNow, preferably Vulnerability Response
- Vulnerability-management workflows
- Tenable and/or Invicti
- CMDB concepts and data management
- Workflow/integration troubleshooting
Basic scripting, APIs, or automation
Familiarity with Splunk or another SIEM
Basic cybersecurity alert triage and analysis
Strong technical documentation and troubleshooting skills
Job description provided by Intellect Solutions.
View the original posting
