Staff Security Engineer (ecurity Operations, Moveworks)

Join the Moveworks Security team at ServiceNow as a Staff Security Engineer. In this role, you will define the architectural framework for AI-driven defense, treat the incident response lifecycle as an advanced engineering problem, and build and optimize agentic networks for maximum performance. You will also architect and scale a proactive threat hunting program, forge a feedback loop between the Blue Team and AI Red Team Agent, and act as a strategic engineering partner across various teams. This position requires a high level of expertise in automation engineering, cloud infrastructure, and AI frameworks.

• Architect and scale a proactive threat hunting program from scratch, leveraging custom agents and security tooling.
• Design, execute, and validate automated simulation testing to systematically prove that agentic workflows and detection pipelines trigger reliably against real-world attack behaviors.
• Act as a strategic engineering partner across IT, Security Engineering, DevOps, DevSecOps, Compliance, Cloud, and Infrastructure teams to ensure corporate systems are natively "automation-ready."
• This is a role for a visionary engineer who wants to push the boundaries of what agentic AI can achieve in enterprise defense
• Cross-Functional Mastery: 3–5 years of proven track record working closely across multidisciplinary teams including Cloud Infrastructure, DevOps, DevSecOps, Compliance, and IT. Bonus points for direct collaboration experience with Product Security or Data Security teams
• Automation Engineering: High proficiency in Python and software engineering principles. You have extensive past experience with traditional workflow engines and legacy SOAR tooling, giving you the context needed to successfully replace them with AI-native alternatives
• U.S. Citizenship Required: (Must meet strict compliance/FedRAMP criteria)
• FedRAMP & Trust Awareness: While an engineer first, you possess the communication skills and security compliance maturity to translate framework controls into automated, code-driven evidence generation pipelines
• Cloud & Infrastructure Depth: Strong, hands-on architectural familiarity with AWS security ecosystems (IAM, CloudTrail, GuardDuty) and containerized environments (Kubernetes/EKS)
• Experience: 8–10 years of experience in Security Operations, Systems Engineering, or DevSecOps (Minimum 5 years of highly relevant engineering experience required)
• AI & Agentic Fluency: Deep familiarity with modern LLM agent frameworks, including active research into their application, performance trade-offs, and behavioral guardrails. You know how to deeply integrate LLMs, orchestrate custom MCP servers, and build autonomous technical workflows
• Team & Collaboration Dynamics: A high-autonomy, high-collaboration mindset. You thrive in a lean, elite, fast-moving team environment where you independently drive massive technical impact while mentoring and leveling up surrounding engineers