The ServiceNow Integrated Risk Management & Continuous Authorization & Monitoring Specialist is a leased employee (part-time engagement) to be provided on a 100% remote basis for a duration of up to 24 months.

Responsibilities: The specialist is responsible for providing technical database administrator and developer assistance to mature the development of ServiceNow's CAM module. Key duties include:

Review, Consult, and Develop: Reviewing, consulting on, improving, and continuing the development of existing integrations to centralize organizational-level common control, business system, and application-level assessment & authorization packages, including security control attestation and evidence collection.
Process Assessment and Optimization: Initiating and executing an independent project to assess the existing cybersecurity risk assessment process, current ticket assignment methodologies, prioritization, processing times, and average level of effort. This includes examining workflows to optimize/refine processes and establishing realistic processing expectancies for stakeholders based on request type.
Standardization and Documentation: Proposing standardization improvements by helping establish cybersecurity risk documentation templates for stakeholders to use when initiating ServiceNow ticket requests more efficiently. Reviewing historical metrics to identify trends (e.g., peak submission times) and proposing efficiencies to manage the ticket queue within resource constraints.
Stakeholder Collaboration: Collaborating directly with Client's Cybersecurity Awareness, Training, and Education program to raise user awareness regarding tickets requiring risk review. Engaging organizational stakeholders to ensure smooth process development and implementation across the organization for risk assessment functions.
Pilot Execution: Helping execute the initial organizational pilot of the RMF process leveraging ServiceNow IRM and CAM modules, including the assignment and refinement of security control processes (organization-level, system-level, hybrid controls), security artifact/evidence requirements, and providing recommendations for continuous monitoring.
Governance Participation: Attending Client's weekly ServiceNow platform enhancement reviews and weekly ServiceNow change management review board meetings as needed to support change requests or new items brought forward by the Cybersecurity Risk Team. These meetings are supported remotely via MS Teams.

Required Experience:

The documents require a leased employee with a minimum of four (4) years' experience developing, analyzing, and creating efficiencies within ServiceNow workflow processes. Additionally, the candidate must have at least three (3) years' experience customizing Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) capabilities within ServiceNow to align with business objectives and risk appetite of mid to large-sized organizations. The role also demands a minimum of three (3) years' experience working within a governance, risk, and compliance (GRC) environment, executing corporate projects, and engaging organizational stakeholders for risk assessment functions. Furthermore, the candidate must have demonstrated experience developing professional templates to support organizational-level, cybersecurity-focused risk assessment processes.

Preferred Experience:

The documents list several desirable qualifications including ServiceNow Practitioner Implementer or above, ServiceNow Certified System Administrator (CSA), ServiceNow GRC: Integrated Risk Management (IRM) Implementer, ServiceNow Certified Technical Architect (CTA), ISC2 CISSP, ISC2 CGRC or CAP, ISACA CISM, ISACA CRISC, CompTIA CASP+, CompTIA Security+, and a B.S. in Computer Science, MIS, or Cybersecurity from an accredited university.

Education:

The documents require the candidate to have a strong foundational understanding of NIST's Cybersecurity (CSF) and Risk Management Frameworks (RMF), including hands-on experience aligning CSF and RMF functions within ServiceNow IRM/CAM modules. The role also requires recent engagement with ServiceNow IRM (minimum 3 years' experience) and active engagement with ServiceNow CAM (minimum 1 year continuous operation).

Skills:

The role requires a strong understanding of NIST's CSF and RMF, including familiarity with navigating Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53). The specialist must possess strong communication, written, and collaboration skills to articulate highly technical information to the project team both verbally and in writing.

Technologies:

The role is exclusively focused on ServiceNow, specifically its Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) modules. The specialist will work within Client's existing ServiceNow deployment, utilizing tools like MS Teams for remote meeting support.

Certifications:

The documents list several desirable certifications including ServiceNow Practitioner Implementer or above, ServiceNow Certified System Administrator (CSA), ServiceNow GRC: Integrated Risk Management (IRM) Implementer, ServiceNow Certified Technical Architect (CTA), ISC2 CISSP, ISC2 CGRC or CAP, ISACA CISM, ISACA CRISC, CompTIA CASP+, CompTIA Security+, and a B.S. in Computer Science, MIS, or Cybersecurity from an accredited university.

Location: 100% Remote.

Arrangement: Workdays Mon - Fri, 4 hours each day; Schedule between 8am and 5pm Pacific Time (Start and end times negotiable); Duration: 24-months (Start ASAP).

Mandatory qualifications:

Minimum of four (4) years' experience developing, analyzing, and creating efficiencies within ServiceNow workflow processes.
Minimum of three (3) years' experience customizing Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) capabilities within ServiceNow to align with business objectives and risk appetite of mid to large-sized organizations.
Minimum of three (3) years' experience working within a governance, risk, and compliance (GRC) environment, with a proven track record of executing corporate projects and growth-based initiatives.
Minimum of three (3) years' experience working on cross-collaborative efforts, involving establishing partnerships between business units, independently analyzing and engaging organizational stakeholders as needed to ensure smooth process development and implementation across the organization for risk assessment functions.
Demonstrated experience developing professional templates to support organizational-level, cybersecurity-focused risk assessment processes.
Proposed resource must have a recent ServiceNow Integrated Risk Management (IRM) engagement with a minimum of three (3) years' experience and an active ServiceNow Continuous Authorization and Monitoring (CAM) engagement with a minimum of one (1) year continuous operation.
Must have strong foundational understanding of NIST's Cybersecurity and Risk Management Framework (CSF/RMF), including hands-on experience aligning CSF and RMF functions within ServiceNow IRM/CAM modules.

Desired Qualifications:

ServiceNow Practitioner Implementer or above (e.g., Professional Implementer).
ServiceNow Certified System Administrator (CSA).
ServiceNow GRC: Integrated Risk Management (IRM) Implementer.
ServiceNow Certified Technical Architect (CTA).
ISC2 Certified Information Systems Security Professional (CISSP).
ISC2 Certified – Governance Risk and Compliance (CGRC) or Certified Authorization Professional (CAP).
ISACA Certified Information Security Manager (CISM).
ISACA Certified in Risk and Information Systems Control (CRISC).
CompTIA Certified Advanced Security Practitioner (CASP+).
CompTIA Security+.
B.S. Computer Science (CS), Management of Information Systems (MIS), or Cybersecurity from an accredited university.

Estrada Consulting Incorporated

ServiceNow Integrated Risk Management & Continuous Authorization & Monitoring Specialist

About the Job