Principal Security Engineer

About the role

This is a principal-level security architecture and strategy role with enterprise-wide scope at ServiceNow. You will set security direction across the company's products and platforms, define the controls and standards teams build against, and act as a technical authority on complex and emerging threats, including those introduced by AI and agentic systems. You will also drive the use of AI to strengthen security itself, partnering with security research teams and representing the security posture to external standards bodies and executive leadership.

Key responsibilities

• Contribute to the security strategy and reference architecture across the company's products and platforms
• Lead threat modeling for complex and novel systems, including AI and agentic systems
• Define platform-wide security standards, including access-control and data-boundary models
• Establish what secure-by-design means for new technologies, including AI, and drive adoption across engineering organisations
• Set methodology and priorities for red-teaming and security assessment programs
• Apply AI to strengthen security work, such as detection, triage, vulnerability discovery and design review
• Make or approve security risk decisions for high-impact initiatives crossing organisational boundaries
• Represent ServiceNow's security posture to standards bodies, industry forums and executive leadership
• Develop senior security engineers and shape the team's technical agenda

Required profile

• Bachelor's, Master's or PhD in Computer Science or a related field, or an exceptional record of impact
• Either a security-led path (13+ years in security, including at least 3 years in principal-level roles owning architecture, risk or threat modeling) or an engineering-led path (13+ years of software engineering, including at least 3 years building or owning security-critical systems, with a move into security ownership at enterprise scale)
• A sustained record of setting security direction across multiple teams or product lines, with standards, controls or architecture adopted as a baseline
• Recognised depth in at least one core security discipline (application, cloud, identity, cryptography or offensive security) with breadth across the others
• Track record of developing principal- and staff-level security leaders and influencing senior executives and engineering leaders

Required skills

• Expert fluency in threat modelling methodologies (e.g. STRIDE, attack trees) and frameworks such as the OWASP Top 10
• Ability to ramp quickly on new technology domains and reason about security where no established patterns exist
• Clear, precise communication with executive audiences and influence without direct authority
• Bonus: depth in AI security, including threat modeling for LLM, GenAI or agentic systems, and hands-on familiarity with frameworks such as LangChain, LangGraph, MCP and A2A