[Hiring] ServiceNow Integrated Risk Management & Continuous Authorization & Monitoring Specialist @Estrada Consultingorporated

Role Description

The ServiceNow Integrated Risk Management & Continuous Authorization & Monitoring Specialist is a leased employee (part-time engagement) to be provided on a 100% remote basis for a duration of up to 24 months.

• Review, Consult, and Develop:
  • Reviewing, consulting on, improving, and continuing the development of existing integrations to centralize organizational-level common control, business system, and application-level assessment & authorization packages, including security control attestation and evidence collection.
• Process Assessment and Optimization:
  • Initiating and executing an independent project to assess the existing cybersecurity risk assessment process, current ticket assignment methodologies, prioritization, processing times, and average level of effort.
  • Examining workflows to optimize/refine processes and establishing realistic processing expectancies for stakeholders based on request type.
• Standardization and Documentation:
  • Proposing standardization improvements by helping establish cybersecurity risk documentation templates for stakeholders to use when initiating ServiceNow ticket requests more efficiently.
  • Reviewing historical metrics to identify trends (e.g., peak submission times) and proposing efficiencies to manage the ticket queue within resource constraints.
• Stakeholder Collaboration:
  • Collaborating directly with Client's Cybersecurity Awareness, Training, and Education program to raise user awareness regarding tickets requiring risk review.
  • Engaging organizational stakeholders to ensure smooth process development and implementation across the organization for risk assessment functions.
• Pilot Execution:
  • Helping execute the initial organizational pilot of the RMF process leveraging ServiceNow IRM and CAM modules, including the assignment and refinement of security control processes (organization-level, system-level, hybrid controls), security artifact/evidence requirements, and providing recommendations for continuous monitoring.
• Governance Participation:
  • Attending Client's weekly ServiceNow platform enhancement reviews and weekly ServiceNow change management review board meetings as needed to support change requests or new items brought forward by the Cybersecurity Risk Team.
  • These meetings are supported remotely via MS Teams.

Qualifications

• Minimum of four (4) years' experience developing, analyzing, and creating efficiencies within ServiceNow workflow processes.
• At least three (3) years' experience customizing Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) capabilities within ServiceNow.
• Minimum of three (3) years' experience working within a governance, risk, and compliance (GRC) environment.
• Demonstrated experience developing professional templates to support organizational-level, cybersecurity-focused risk assessment processes.

Requirements

• Strong foundational understanding of NIST's Cybersecurity (CSF) and Risk Management Frameworks (RMF).
• Hands-on experience aligning CSF and RMF functions within ServiceNow IRM/CAM modules.
• Recent engagement with ServiceNow IRM (minimum 3 years' experience).
• Active engagement with ServiceNow CAM (minimum 1 year continuous operation).

Benefits

• 100% Remote work arrangement.
• Workdays Mon - Fri, 4 hours each day; Schedule between 8am and 5pm Pacific Time (Start and end times negotiable).
• Duration: 24-months (Start ASAP).

Desired Qualifications

• ServiceNow Practitioner Implementer or above (e.g., Professional Implementer).
• ServiceNow Certified System Administrator (CSA).
• ServiceNow GRC: Integrated Risk Management (IRM) Implementer.
• ServiceNow Certified Technical Architect (CTA).
• ISC2 Certified Information Systems Security Professional (CISSP).
• ISC2 Certified – Governance Risk and Compliance (CGRC) or Certified Authorization Professional (CAP).
• ISACA Certified Information Security Manager (CISM).
• ISACA Certified in Risk and Information Systems Control (CRISC).
• CompTIA Certified Advanced Security Practitioner (CASP+).
• CompTIA Security+.
• B.S. in Computer Science, Management of Information Systems, or Cybersecurity from an accredited university.