Location: Rockville, MD (Primarily Onsite)

Position Summary

The SecDevOps / ServiceNow SME supports NIAID SIRT cybersecurity operations through the maintenance, administration, and enhancement of ServiceNow Vulnerability Response workflows, cybersecurity tool integrations, vulnerability-management automation, and related SecDevOps activities. The position also provides limited support to SOC security-alert review and triage as operational needs permit.

Primary Responsibilities

ServiceNow Vulnerability Response / SecDevOps

• Maintain and support ServiceNow Vulnerability Response (VR) operations.
• Monitor SecOps health dashboards and scheduled jobs.
• Support and troubleshoot Tenable and Invicti integrations with ServiceNow VR.
• Reclassify discovered items and address vulnerability-record data issues.
• Maintain and update vulnerability assignment rules.
• Identify appropriate support groups and support applicable CMDB updates.
• Maintain and improve automated routing of vulnerabilities to responsible support teams.
• Troubleshoot VR workflow, integration, and data-quality issues.

Integration & Enhancement

• Support development, testing, and implementation of cybersecurity integrations and workflow enhancements.
• Support ongoing initiatives such as GitHub Advanced Security integration and SCCM Patch Orchestration.
• Assist with ServiceNow/CMDB integration and data-quality improvements.
• Coordinate with NIH/ServiceNow administrators when required changes exceed SIRT permissions or access.

SOC Support

• Provide secondary support for review and initial triage of Splunk security alerts as workload and operational priorities permit.
• Assist with gathering available security context needed to evaluate alerts.
• Escalate potentially significant security activity to the Cybersecurity Analyst/SOC Lead for further investigation.
• Provide feedback on repetitive or noisy alerts that may benefit from tuning or automation.

Documentation & Continuity

• Maintain technical documentation and operational procedures for supported workflows and integrations.
• Support knowledge transfer and cross-training within SIRT to reduce single-person dependencies.

Desired Experience

• ServiceNow, preferably Vulnerability Response
• Vulnerability-management workflows
• Tenable and/or Invicti
• CMDB concepts and data management
• Workflow/integration troubleshooting
• Basic scripting, APIs, or automation
• Familiarity with Splunk or another SIEM
• Basic cybersecurity alert triage and analysis
• Strong technical documentation and troubleshooting skills