Location: Rockville, MD (Primarily Onsite)
Position Summary
The SecDevOps / ServiceNow SME supports NIAID SIRT cybersecurity operations through the maintenance, administration, and enhancement of ServiceNow Vulnerability Response workflows, cybersecurity tool integrations, vulnerability-management automation, and related SecDevOps activities. The position also provides limited support to SOC security-alert review and triage as operational needs permit.
Primary Responsibilities
ServiceNow Vulnerability Response / SecDevOps
- Maintain and support ServiceNow Vulnerability Response (VR) operations.
- Monitor SecOps health dashboards and scheduled jobs.
- Support and troubleshoot Tenable and Invicti integrations with ServiceNow VR.
- Reclassify discovered items and address vulnerability-record data issues.
- Maintain and update vulnerability assignment rules.
- Identify appropriate support groups and support applicable CMDB updates.
- Maintain and improve automated routing of vulnerabilities to responsible support teams.
- Troubleshoot VR workflow, integration, and data-quality issues.
Integration & Enhancement
- Support development, testing, and implementation of cybersecurity integrations and workflow enhancements.
- Support ongoing initiatives such as GitHub Advanced Security integration and SCCM Patch Orchestration.
- Assist with ServiceNow/CMDB integration and data-quality improvements.
- Coordinate with NIH/ServiceNow administrators when required changes exceed SIRT permissions or access.
SOC Support
- Provide secondary support for review and initial triage of Splunk security alerts as workload and operational priorities permit.
- Assist with gathering available security context needed to evaluate alerts.
- Escalate potentially significant security activity to the Cybersecurity Analyst/SOC Lead for further investigation.
- Provide feedback on repetitive or noisy alerts that may benefit from tuning or automation.
Documentation & Continuity
- Maintain technical documentation and operational procedures for supported workflows and integrations.
- Support knowledge transfer and cross-training within SIRT to reduce single-person dependencies.
Desired Experience
- ServiceNow, preferably Vulnerability Response
- Vulnerability-management workflows
- Tenable and/or Invicti
- CMDB concepts and data management
- Workflow/integration troubleshooting
- Basic scripting, APIs, or automation
- Familiarity with Splunk or another SIEM
- Basic cybersecurity alert triage and analysis
- Strong technical documentation and troubleshooting skills
