IT Security Engineer IV

Hands-on experience administering the ServiceNow Security Incident Response (SIR) module: configuring security incident workflows, business rules, assignment logic, and SIEM/SOAR/API integrations, and maintaining the module in a production SOC environment. Key responsibilities: Administer and enhance the ServiceNow Security Incident Response (SIR) module: security incident workflows, assignment and escalation rules, SLA definitions, form and UI configuration, and integrations with SIEM, SOAR, and threat intelligence sources.

• Administer and enhance the ServiceNow Security Incident Response (SIR) module: security incident workflows, assignment and escalation rules, SLA definitions, form and UI configuration, and integrations with SIEM, SOAR, and threat intelligence sources.
• Design, build, and maintain the Detection-as-Code (DaC) pipeline: detection development, version control, CI/CD-based testing, and automated deployment.
• Develop and tune detections across EDR, cloud, network, email, and DLP telemetry.
• Build SOAR playbooks, API integrations, and automation to streamline SOC workflows.
• Support administration and optimization of the SIEM/SOAR platform stack.
• Contribute to AI SOC initiatives: investigation coverage expansion, alert triage automation, and integration health.
• Apply MITRE Telecommunication & CK mapping, FP-rate gating*** and detection lifecycle standards to all deployed content.
• Partner with SOC analysts and incident response to translate operational gaps into engineering solutions.

• Proven SOC experience (detection engineering, security engineering, or senior analyst capacity) with a demonstrable engineering mindset.
• Hands-on experience administering the ServiceNow Security Incident Response (SIR) module: configuring security incident workflows, business rules, assignment logic, and SIEM/SOAR/API integrations, and maintaining the module in a production SOC environment.
• Hands-on automation and scripting, primarily Python, and experience building or contributing to Detection-as-Code pipelines.
• Strong grounding in MITRE Telecommunication & CK, Pyramid of Pain, Cyber Kill Chain, and the incident response process and its phases.
• Deep understanding of at least one of: endpoint security (macOS and Windows internals, telemetry, detection) or cloud infrastructure (cloud-native services, Kubernetes, runtime detection).
• Solid networking fundamentals, including DNS.
• Working knowledge of IAM, SSO (SAML/OIDC), and Zero Trust architecture concepts.
• Working knowledge of Data Loss Prevention concepts and detection use cases.
• Understanding of AI Detection & Response: securing and monitoring AI/LLM usage in the enterprise.
• Familiarity with agentic AI frameworks and applying AI to SOC operations and detection engineering workflows.

• ServiceNow certifications relevant to the platform (e.g., Certified System Administrator, Security Incident Response implementation experience).
• CI/CD tooling (Git, GitHub Actions or similar) for security content deployment.
• Experience integrating AI/LLM capabilities into SOC triage or detection pipelines.
• Familiarity with Risk-Based Alerting concepts.

For workers in the United States, PrideGlobal and it's affiliates offers eligible employee’s comprehensive healthcare coverage (medical, dental, and vision plans), supplemental coverage (accident insurance, critical illness insurance and hospital indemnity), 401(k)-retirement savings, life & disability insurance, an employee assistance program, legal support, pet insurance and employee discounts with preferred vendors.

Equal Employment Opportunity
PrideGlobal and it's affiliates are an equal opportunity employer. We do not discriminate on the basis of the race, religious creed, color, national origin, ancestry, physical disability, mental disability, reproductive health decision making, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, age, sexual orientation, veteran or military status, or any other characteristic protected by applicable federal, state, or local law.

Fair Chance Employment
PrideGlobal and it's affiliates are a Fair Chance employer. We consider all qualified applicants, including those with criminal histories, in a manner consistent with applicable state and local Fair Chance laws and ordinances, including, the California Fair Chance Act and all applicable local Fair Chance ordinances.

Accommodations
We are committed to providing reasonable accommodations to applicants and employees with disabilities. If you require a reasonable accommodation to participate in the application or interview process, or to perform the essential functions of this role, please contact us.

Only applicable for San Francisco Candidates: Under the San Francisco Lactation in the Workplace Ordinance, we will provide written notice of lactation accommodation rights, and this notice will automatically be given upon hiring, any inquiry of parental leave or lactation accommodation.

Only applicable for Kentucky positions: For this type of employment, state law requires a criminal record check as a condition of employment. This applies to direct care staff (Examples: RN, LPN, Nurse Aides, Therapists) referred to Kentucky nursing facilities, assisted living communities, or long-term care facilities, in accordance with KRS 216.793.