It all started when engineer Fred Luddy wrote code that automated a tedious task for his coworker, Phyllis. She cried tears of joy. That moment inspired Fred to build a company that could do that for everyone—freeing people from busywork so they could focus on meaningful work. Today, ServiceNow is the AI control tower for business reinvention. Our ServiceNow AI platform brings together any AI, any data, and any workflow— helping 85% of the Fortune 500® work smarter, faster, and better. We're building an AI-native culture where technology and talent are unstoppable together. And we're just getting started.
Join us to put AI to work for people.
Location: Spain ( Required)
Role Overview
The Expert, Application Security & VIPR is a hands-on technical leader responsible for architecting, automating, and continuously improving Armis’ application security posture—while ensuring application vulnerabilities are fully integrated into Armis’ VIPR framework.
This role bridges engineering, product security, and vulnerability management, defining how application risks are identified, prioritized, contextualized, and remediated across Armis’ SaaS and on-prem platforms. You will ensure that AppSec findings are not siloed, but instead correlated with asset intelligence, exploitability, exposure, and business impact.
Key Responsibilities
Application Security Leadership
Lead the Application Security program across all Armis products, embedding security throughout the SDLC.
Perform secure design and architecture reviews, partnering with engineering teams to identify and mitigate risk early.
Conduct and lead threat modeling sessions using STRIDE, DREAD, or PASTA methodologies.
VMDR Integration & Vulnerability Lifecycle
Own application-layer vulnerability management as part of Armis’ VIPR strategy, from detection through remediation and validation.
Integrate AppSec findings (SAST, DAST, SCA, API testing) into centralized vulnerability workflows, risk scoring, and prioritization models.
Correlate application vulnerabilities with asset context, exploit intelligence, and business criticality to drive risk-based remediation.
Track and report VMDR metrics such as MTTD, MTTR, exposure windows, and remediation effectiveness for application vulnerabilities.
Automation & Tooling
Build and maintain automated AppSec pipelines for SAST, DAST, SCA, and API security testing.
Collaborate with DevOps to integrate security scanning into CI/CD pipelines (GitHub Actions, Jenkins, Buildkite).
Partner with Cloud and Infrastructure Security to secure APIs, microservices, and containerized workloads (Docker, Kubernetes).
Engineering Partnership & Enablement
Develop and maintain secure coding standards and security baselines for React, Node.js, Python, Java, and Go.
Mentor engineers and security champions; deliver secure coding training and threat modeling workshops.
Act as a trusted advisor to engineering leadership, translating vulnerabilities into clear risk and remediation guidance.
Compliance & Assurance
Support compliance and audit readiness including SOC 2, ISO 27001, FedRAMP, and HIPAA, ensuring application risks are documented and managed within VIPR /AppSec processes.
Required Qualifications
7–10+ years of experience in Application Security, Product Security, or Secure Software Engineering.
Proven expertise in SAST, DAST, SCA, and dependency management tools (e.g., Veracode, Checkmarx, Fortify, Snyk, SonarQube, OWASP Dependency-Check).
Preferred Skills
Experience in a SaaS, cloud-native, or cybersecurity product company.
Hands-on experience integrating AppSec into broader VIPR or exposure management programs.
Familiarity with cloud and container security platforms (Prisma Cloud, Wiz, Orca).
Experience with IaC security (Terraform, CloudFormation).
Exposure to API Gateway security, OAuth2, token-based auth, and zero-trust architectures.
Relevant certifications such as OSWE, CSSLP, GWAPT, GWEB, CEH.
Hands-on coding proficiency in at least two modern languages (Python, JavaScript/TypeScript, Java, Go).
Strong experience managing vulnerabilities end-to-end, including triage, prioritization, remediation tracking, and validation.
Deep understanding of OWASP Top 10, CWE, CVE, and exploitability concepts.
Strong knowledge of CI/CD pipelines, Git-based workflows, and secure build automation.
Experience with threat modeling, secure architecture reviews, and microservices/API security.
Ability to clearly communicate technical risk to both engineering teams and business stakeholders.
Work Personas
We approach our distributed world of work with flexibility and trust. Work personas (flexible, remote, or required in office) are categories that are assigned to ServiceNow employees depending on the nature of their work and their assigned work location. Learn more here. To determine eligibility for a work persona, ServiceNow may confirm the distance between your primary residence and the closest ServiceNow office using a third-party service.
Equal Opportunity Employer
ServiceNow is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, national origin, age, disability, gender identity, veteran status, or any other category protected by law. In addition, all qualified applicants with arrest or conviction records will be considered for employment in accordance with legal requirements.
Accommodations
We strive to create an accessible and inclusive experience for all candidates. If you require a reasonable accommodation to complete any part of the application process, or are unable to use this online application and need an alternative method to apply, please contact [email protected] for assistance.
Export Control Regulations
For positions requiring access to controlled technology subject to export control regulations, including the U.S. Export Administration Regulations (EAR), ServiceNow may be required to obtain export control approval from government authorities for certain individuals. All employment is contingent upon ServiceNow obtaining any export license or other approval that may be required by relevant export control authorities.
From Fortune. ©2026 Fortune Media IP Limited. All rights reserved. Used under license.