ServiceNow IRM Consultant

Key Responsibilities

• Initiate and execute an independent project focused on assessing the existing cybersecurity risk assessment process.

• Assess the current methodology for ServiceNow Cybersecurity Risk ticket assignment, ticket types, ticket prioritization, processing times, and average level of effort required to resolve and close tickets, including hours and collaboration with internal and external stakeholders.

• Assess the current assignment workflow within the existing ServiceNow deployment, focusing on optimization and refinement of existing processes and establishing realistic processing expectations for stakeholders based on request type.

• Review the information and details requested for processing ServiceNow tickets and recommend standardization improvements.

• Develop cybersecurity risk documentation templates for stakeholders to use when initiating ServiceNow ticket requests requiring cybersecurity risk assessments.

• Review historical ServiceNow Cybersecurity Risk ticket processing metrics to identify trends, including peak ticket submission timeframes, and propose efficiencies to effectively manage the cybersecurity risk ticket queue while considering limited personnel resources.

• Formally present proposed recommendations to Cybersecurity Department Leadership for review and approval.

• Document approved cybersecurity risk ticket processing recommendations in a process methodology that outlines expected processing timelines, minimum entrance criteria for ticket processing, and best-practice recommendations for ticket submissions.

• Collaborate directly with the Cybersecurity Awareness, Training, and Education program to determine the best course of action to raise awareness among users planning to submit tickets requiring cybersecurity risk review or assessment.

• Help execute the initial organizational pilot of the RMF process using ServiceNow IRM and CAM modules.

• Support the assignment and refinement of the security control process, including organization-level owned controls, system-level controls, and hybrid controls, as well as security artifact/evidence requirements.

• Modify existing ServiceNow workflows and create new workflows to support Cybersecurity Risk Team process efficiencies.

• Attend weekly ServiceNow platform enhancement reviews and weekly ServiceNow change management review board meetings as needed to support change requests or new items brought forward by the Cybersecurity Risk Team.

• Participate in meetings remotely via MS Teams.

Mandatory Requirements

• Minimum of four (4) years' experience developing, analyzing, and creating efficiencies within ServiceNow workflow processes.

• Minimum of three (3) years' experience customizing Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) capabilities within ServiceNow to align with business objectives and risk appetite of mid- to large-sized organizations.

• Minimum of three (3) years' experience working within a governance, risk, and compliance (GRC) environment, with a proven track record of executing corporate projects and growth-based initiatives.

• Minimum of three (3) years' experience working on cross-collaborative efforts, involving establishing partnerships between business units, independently analyzing and engaging organizational stakeholders as needed to ensure smooth process development and implementation across the organization for risk assessment functions.

• Demonstrated experience developing professional templates to support organizational-level, cybersecurity-focused risk assessment processes.

• Recent ServiceNow Integrated Risk Management (IRM) engagement with a minimum of three (3) years' experience and an active ServiceNow Continuous Authorization and Monitoring (CAM) engagement with a minimum of one (1) year of continuous operation.

• Strong foundational understanding of NIST's Cybersecurity and Risk Management Framework (CSF/RMF), including hands-on experience aligning CSF and RMF functions within ServiceNow IRM/CAM modules.

Desirable Qualifications

• ServiceNow Practitioner Implementer or above (e.g., Professional Implementer).

• ServiceNow Certified System Administrator (CSA).

• ServiceNow GRC: Integrated Risk Management (IRM) Implementer.

• ServiceNow Certified Technical Architect (CTA).

• ISC2 Certified Information Systems Security Professional (CISSP).

• ISC2 Certified – Governance Risk and Compliance (CGRC) or Certified Authorization Professional (CAP).

• ISACA Certified Information Security Manager (CISM).

• ISACA Certified in Risk and Information Systems Control (CRISC).

• CompTIA Certified Advanced Security Practitioner (CASP+).

• CompTIA Security+.

• B.S. in Computer Science (CS), Management of Information Systems (MIS), or Cybersecurity from an accredited university.