Senior Manager - Product Red Team

About the role

ServiceNow is seeking an experienced offensive security leader to establish and direct a new Product Red Team. This function performs simulated attacks against synthetic customer environments to uncover vulnerabilities and design weaknesses before they are exploited by external threats.

Key facts

What you'll do

• Define the operational objectives, engagement criteria, and rules of engagement for the team.
• Design testing frameworks including vulnerability risk assessments and adversarial campaigns.
• Build team capabilities in exploit development, threat emulation, and AI-specific attack vectors such as prompt injection and model manipulation.
• Execute complex offensive operations simulating full attack paths from initial access to data staging.
• Establish success metrics including kill chain coverage and remediation velocity.
• Collaborate with product engineering, detection engineering, and leadership to drive security improvements and influence design decisions.
• Mentor staff on operational security tradecraft and documentation standards.
• Provide executive briefings on emerging threats and systemic security gaps.

Requirements

• 12+ years of experience in offensive security.
• 5+ years of experience leading offensive operations teams in high-consequence environments.
• Background in covert offensive cyber operations within intelligence communities, military settings, or top-tier private-sector adversary emulation teams.
• Expertise in MITRE ATT&CK methodologies, exploit development, and persistence mechanisms.
• Proficiency in detection evasion and command and control operations within SaaS environments.
• Ability to manage security operations under ambiguous conditions and strict rules of engagement.
• Understanding of SDLC integration, CI/CD pipelines, and SaaS threat modeling.

Nice to have

• Experience leading red teams specifically against software products or SaaS platforms.
• Knowledge of software supply chain security and cloud infrastructure testing in AWS, Azure, or GCP.
• Published security research or presentations at major security conferences.
• Familiarity with containerized environments and enterprise customer deployment patterns.

Skills & tools

• Threat actor emulation
• Exploit development
• Kill chain analysis
• SaaS security
• AI-specific security (prompt injection, model poisoning)
• Security control validation
• Operational security (OPSEC)

Practical notes

• This role involves coordination across time zones from the US West Coast to India.
• Employment is contingent upon obtaining any necessary export control licenses or government approvals as required by regulations such as the U.S. Export Administration Regulations.
• ServiceNow is an equal opportunity employer. Candidates requiring accommodations during the application process may contact globaltalentss@servicenow.com.