Senior Application Security Engineer

About the role

ServiceNow is looking for a Senior Application Security Engineer to lead the technical core of its bug bounty program within the Product Security Incident Response Team (PSIRT). You will own bug bounty reports from intake through resolution, reproducing vulnerabilities, analyzing root causes, and verifying fixes while communicating directly with external researchers.

Key responsibilities

• Own end‑to‑end triage of bug bounty reports: intake, reproduction, severity scoring, root‑cause analysis, fix verification, and final disposition.
• Reproduce and validate reported vulnerabilities, extending incomplete proof‑of‑concept code when needed.
• Serve as the escalation point for complex, high‑severity issues, including multi‑step exploit chains and cross‑system attacks.
• Conduct code reviews to identify underlying defects and propose or design remediations with engineering teams.
• Assign and defend severity ratings using the program’s framework and maintain accurate vulnerability records.
• Act as the primary technical liaison for bug bounty researchers, handling disputes and translating findings for internal stakeholders.
• Lead variant hunts, original platform security research, major product security incidents, and forensic post‑mortems.

Required profile

• Senior‑level security professional with deep experience in application security and vulnerability analysis.
• Proven ability to mentor junior engineers and set triage standards.
• Excellent written and verbal communication skills for interacting with external researchers and internal teams.
• Strong analytical mindset to trace bugs from symptom to root cause.

Required skills

• Bug bounty program management
• Vulnerability reproduction and validation
• Code review and root‑cause analysis
• Severity scoring and remediation design
• Security research and incident response