Senior Manager - Product Red Team

It all started when engineer Fred Luddy wrote code that automated a tedious task for his coworker, Phyllis. She cried tears of joy. That moment inspired Fred to build a company that could do that for everyone—freeing people from busywork so they could focus on meaningful work. Today, ServiceNow is the AI control tower for business reinvention. Our ServiceNow AI platform brings together any AI, any data, and any workflow— helping 85% of the Fortune 500® work smarter, faster, and better. We're building an AI-native culture where technology and talent are unstoppable together. And we're just getting started. Join us to put AI to work for people.

ServiceNow seeks an experienced offensive security leader to build and lead the Product Red Team. This newly established function emulates real-world attacks against synthetic ServiceNow customer instances to identify vulnerabilities, misconfigurations, and design gaps before external threat actors or researchers discover them. This role requires an operator who has led offensive security operations in high-consequence environments—covert intelligence or military settings preferred—with proven ability to establish operational standards, navigate ambiguous mission parameters, and influence cross-functional stakeholders around complex security trade-offs. You will build upon this team's charter, engagement frameworks, and rules of engagement with other teams. You will help drive ServiceNow's product security and response posture through adversary emulation, vulnerability research, exploit development, and collaboration with other offensive and defensive teams.

Establish Operations Objectives, Policies & Procedures Own Product Red Team's operation objectives and engagement selection criteria in alignment with product security roadmap and risk register, CISO directives, and company priorities. Expand upon rules of engagement, threat actor emulation standards, testing policies, and protocols. Establish operational security procedures for covert operations, detection evasion, and incident response protocols. Create escalation procedures and approval frameworks for high-risk engagements. Own campaign selection processes, engagement proposal templates, and findings documentation and readout standards. Define Engagement Framework & Success Metrics Design and implement engagement types: vulnerability risk assessment, product security assessments, and ongoing adversarial campaigns. Establish and report on technical and operational success metrics: kill chain coverage, remediation velocity, and detection engineering insights. Create reporting templates—technical findings, executive briefings, engineering recommendations—that drive actionable remediation. Define boundaries and operational testing windows in coordination with product engineering and detection engineering teams. Lead Offensive Operations Team Build team capability across threat actor emulation, exploit development, persistence mechanisms, supply chain security, and AI-specific attack vectors (prompt injection, model manipulation, data poisoning). Mentor team on operational security tradecraft, documentation discipline, and risk management under ambiguous conditions. Support team members in their time zones, spanning from US West Coast to India. Conduct Complex Offensive Operations Design and execute operations simulating realistic attack paths against synthetic customer instances—from initial access through persistence, lateral movement, and data staging. Demonstrate real-world exploitability of vulnerability chains, design flaws, and configuration gaps. Validate security controls, detection capabilities, and logging sufficiency across kill chain phases. Identify and exploit legitimate ServiceNow features for malicious purposes