Senior Application Security Engineer

📋 Description

• Own bug bounty reports end-to-end: intake, reproduction, severity scoring, root cause analysis, fix
• Reproduce vulnerabilities, build proof-of-concept code, and validate findings.
• Escalate complex, high-severity reports including multi-step exploits.
• Review code to identify underlying defects and propose fixes or designs.
• Define and defend severity ratings; track defects to closure.

🎯 Requirements

• 8+ years in product security, application security, penetration testing, or vulnerability research.
• Deep knowledge of web/application vulnerability classes and exploitation techniques.
• Strong code comprehension in Java, JavaScript, and Python; ability to trace root cause in large
• Ability to write code and propose concrete fixes; working knowledge of Git, Gradle, Maven, CI/CD
• Proficiency with Claude Code or similar AI coding assistants for code comprehension and security
• Exceptional written communication; ability to represent ServiceNow to external researchers.

🎁 Benefits

• Flexible work personas and distributed work options.
• Equal Opportunity Employer and accommodations on request.
• Export control and compliance considerations as applicable.