Cyber ServiceNow Secops/SIR Engagement Manager

About the Role

Our Deloitte Cyber team delivers powerful solutions to help clients navigate the ever-changing threat landscape. We enable clients to operate with resilience, grow with confidence, and proactively manage to secure success through managed services that simplify complexity.

Key Responsibilities

• Drive strategic direction of initial workshops, including Phase 0 planning and Phase 1 requirements gathering/implementation planning.
• Lead end-to-end delivery of multi-workstream SIR programs, managing scoping, schedule, budget, risks, assumptions, issues, dependencies, and quality.
• Establish delivery governance and operating rhythms, driving backlog, sprint, and release planning across SIR, Major Security Incident Management, Data Loss Prevention, Threat Intelligence Security Center (TISC), and related SecOps workstreams.
• Synthesize requirements, drive epic and user story creation, and initiate development work by leveraging Business Process Consultants, Solution Architects, and Technical Consultants.
• Act as a liaison for project teams, facilitating touchpoints to generate design decisions, remove blockers, and maintain execution velocity.
• Manage stakeholder engagement and executive communications with CISOs and SOC and incident response leaders, facilitating decisions, change control, and status reporting with clear KPIs, value realization, and adoption metrics.
• Guide executive and program stakeholders through the transition from current-state processes and tools to ServiceNow-aligned architecture, including migration approach, customization decisions, sequencing, and change impact.
• Engage with internal and client-facing PMO teams, delineating responsibilities and aligning status reporting for risks, actions, issues, and dependencies.
• Lead implementation planning, including cutover from legacy case management or SOAR tools, training direction, and User Acceptance Testing preparation.
• Orchestrate cross-functional teams and vendors across onshore and offshore models, aligning resources and mitigating delivery risks, blockers, and interdependencies.
• Lead, staff, and develop Consultants and Senior Consultants, setting the quality bar and coaching for growth.
• Oversee pre-sales through delivery handoff, including scoping, estimates, staffing plans, delivery approach, and transition-to-operations readiness.

Requirements & Tech Stack

• ServiceNow
• SecOps
• SIR
• TISC
• SOAR
• SIEM
• Now Assist for Security Operations
• Performance Analytics
• NIST 800-61, NIST CSF, ISO 27001, MITRE ATT&CK

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Security, Engineering, Information Technology, or Business Administration.
• ServiceNow Certified System Administrator (CSA).
• 6+ years managing or acting as a business process consultant on ServiceNow programs or projects in a client-facing consulting or professional services role.
• 6+ years leading or acting as a business process consultant in multi-workstream ServiceNow deliveries using Agile or hybrid methodologies, including backlog, sprint, and release management.
• 4+ years managing program financials, executive reporting, stakeholder management, and change control.
• 3+ years managing distributed delivery teams, including onshore and offshore resources, vendors, and client personnel.
• Experience guiding client leadership through migration from legacy tools and processes to ServiceNow-aligned architecture and best practices.
• 2+ full lifecycle ServiceNow SIR implementations delivered from initiation through go-live and transition to operations.
• Ability to work independently and collaborate as part of a team.
• Effective written and verbal communication skills.
• Meticulous attention to detail and quality of work product.
• Ability to build and sustain professional relationships.
• Ability to lead projects or workstreams.
• Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment.
• Strong interpersonal skills and professional demeanor.
• Ability to meet deadlines.
• Ability to mentor and provide clear guidance to others.
• Ability to travel 50%, on average.

Preferred Qualifications

• 3+ years delivering ServiceNow Security Incident Response programs.
• ServiceNow Certified Implementation Specialist - Security Incident Response (CIS-SIR).
• ServiceNow Certified Application Developer (CAD).
• ServiceNow Certified Technical Architect (CTA) or Certified Master Architect (CMA).
• Experience leading a SOC platform consolidation or SOAR migration.
• Understanding of high usage SIEM / SOAR tools, as well as market trends.
• Experience with Threat Intelligence Security Center (TISC).
• Experience applying NIST 800-61, NIST CSF, ISO 27001, or MITRE ATT&CK in operating model or platform design.
• Experience delivering Now Assist for Security Operations, AI Specialists, or Performance Analytics.
• Master's degree in Computer Science, Cybersecurity, Information Security, Engineering, or Information Technology.