Summary

Position Summary

Cyber TechRisk - ServiceNow - SecOps – Security Incident Response — Consultant/Senior Consultant

Deloitte's Cyber Risk Services help our clients to be secure, vigilant, and resilient in the face of an ever-increasing array of cyber threats and vulnerabilities. Our Cyber Risk practice helps organizations with the management of information and technology risks by delivering end-to-end solutions using proven methodologies and tools in a consistent manner. Our services help organizations address, in a timely manner, pervasive issues such as identity theft, data security breaches, data leakage, cyber security, and system outages across organizations of various sizes and industries with the goal of enabling ongoing, secure, and reliable operations across the enterprise.

We are seeking an experienced ServiceNow Developer / Consultant with strong hands-on expertise in the Security Incident Response (SIR) module. The ideal candidate will have 3+ years of ServiceNow platform development experience, including at least 2 years focused specifically on implementing and managing Security Incident Response solutions. This role will be responsible for configuring, customizing, integrating, and automating the ServiceNow SIR lifecycle to support incident intake, triage, investigation, containment, remediation, and reporting.

Work you will do

As a Consultant / Senior Consultant, you would be expected to perform the following activities:

Well versed with the application deployment and configuration baselines, and understanding of how the application environment operates in a secure environment and how exceptions are handled during operations.
Facilitate use of technology-based tools or methodologies to continuously improve the monitoring, management, and reliability of the service.
Define the architecture and design elements for the implementation of ServiceNow SecOps solution including design data/object models, technical workflow diagrams, access control models, and integration patterns.
Understand the business requirement and define & document epics, user stories, create UI mock-ups, and have a roll-up-the-sleeves approach to make things happen.
Facilitate ServiceNow training and support teams on complex system configuration.
Collaborate with clients to resolve business problems by translating functional requirements into technical solutions.
Be responsible for end-to-end application design, workflow configurations, and customizations.
Demonstrate good judgment and a pragmatic approach to delivering a solution that optimizes architecture activities across company needs, business constraints, and technological realities.

Key Responsibilities (Security Incident Response)

Configure and administer ServiceNow Security Incident Response including security incident categories, playbooks, assignment rules, severity/priority models, SLAs, notifications, and response tasking.
Design and support incident intake and triage workflows from multiple security sources such as SIEM, SOAR, threat intelligence, email security, EDR/XDR, vulnerability tools, and manual submissions.
Integrate and maintain ingestion from security tools into the ServiceNow SIR application and validate data mapping, transformation logic, schedules, deduplication, and error handling.
Build and maintain automations using Flow Designer / Integration Hub for enrichment, routing, approvals, escalations, containment support, evidence gathering, and closure activities.
Configure incident lifecycle processes covering detection, analysis, triage, investigation, containment, eradication, recovery, and post-incident review.
Partner with SOC, IR, IT Ops, app owners, and resolver groups to coordinate response workflows, manage dependencies, and ensure timely incident remediation.
Define and publish dashboards / KPIs in ServiceNow for incident aging, MTTA, MTTR, SLA compliance, incident trends, severity distribution, and analyst workload.
Support governance through audit-ready evidence, documentation, runbooks, access controls, and change / release management.
Enable linkage between security incidents, vulnerable items, change records, problems, and CMDB CIs to improve traceability and operational response.
Support development of response playbooks and standard operating procedures aligned to enterprise incident management and cyber response requirements.

Optional Responsibilities (Vulnerability Response)

Support integration points between Vulnerability Response and SIR, including creation of security incidents from exploited or high-risk vulnerabilities when needed.

Required Qualifications

3-10 years of ServiceNow experience (Admin/Developer/Platform).
Hands-on experience implementing or operating ServiceNow Security Incident Response.
Strong understanding of the security incident management lifecycle and SOC / IR operating processes.
Experience with CMDB / asset data concepts and how they affect SIR accuracy, ownership, prioritization, and routing.
Working knowledge of integrations (REST / API; MID Server where applicable) and automation (Flow Designer).
Understanding incident prioritization, case handling, escalation models, and response coordination across stakeholders.

Preferred / Nice To Have

ServiceNow CSA (Mandatory), CAD and CIS-SIR/SecOps-related CIS-certifications.
Experience integrating ServiceNow with SIEM / SOAR / EDR platforms.
Scripting (ServiceNow JavaScript), performance tuning, and large-scale data ingestion.

Core Skills

ServiceNow SIR, SecOps, CMDB, Flow Designer / Integration Hub, integrations, reporting / dashboards, security incident lifecycle, stakeholder coordination, communication, and presentation.

Education:

Bachelor's/ Master's degree in information technology or related field

Location:

Bengaluru/Hyderabad/Pune/Chennai

Our purpose

Deloitte's purpose is to make an impact that matters for our people, clients, and communities. At Deloitte, purpose is synonymous with how we work every day. It defines who we are. Our purpose comes through in our work with clients that enables impact and value in their organizations, as well as through our own investments, commitments, and actions across areas that help drive positive outcomes for our communities.

Our people and culture

Our inclusive culture empowers our people to be who they are, contribute their unique perspectives, and make a difference individually and collectively. It enables us to leverage different ways of thinking, ideas and perspectives, and bring more creativity and innovation to help solve our clients most complex challenges. This makes Deloitte one of the most rewarding places to work.

Professional development

At Deloitte, professionals have the opportunity to work with some of the best and discover what works best for them. Here, we prioritize professional growth, offering diverse learning and networking opportunities to help accelerate careers and enhance leadership skills. Our state-of-the-art DU: The Leadership Center in India, located in Hyderabad, represents a tangible symbol of our commitment to the holistic growth and development of our people. Explore DU: The Leadership Center in India .

Benefits To Help You Thrive

At Deloitte, we know that great people make a great organization. Our comprehensive rewards program helps us deliver a distinctly Deloitte experience that helps that empowers our professionals to thrive mentally, physically, and financially—and live their purpose. To support our professionals and their loved ones, we offer a broad range of benefits. Eligibility requirements may be based on role, tenure, type of employment and/ or other criteria. Learn more about what working at Deloitte can mean for you.

Recruiting tips

From developing a stand out resume to putting your best foot forward in the interview, we want you to feel prepared and confident as you explore opportunities at Deloitte. Check out recruiting tips from Deloitte recruiters.

Requisition code: 363121

ServiceNow SecOps SIR - Senior Consultant