Cyber ServiceNow Secops/SIR Engagement Manager

About the Role

Our Deloitte Cyber team helps clients navigate the cybersecurity threat landscape by delivering powerful solutions and managed services that simplify complexity. We enable clients to operate with resilience, grow with confidence, and proactively manage for success.

Key Responsibilities

• Drive strategic direction for initial workshops, including Phase 0 planning and Phase 1 requirements gathering/implementation planning.
• Lead end-to-end delivery of multi-workstream Security Incident Response (SIR) programs, managing scope, schedule, budget, risks, assumptions, issues, dependencies, and quality.
• Establish delivery governance and operating rhythms, driving backlog, sprint, and release planning across SIR, Major Security Incident Management, Data Loss Prevention, Threat Intelligence Security Center (TISC), and related SecOps workstreams in partnership with architects and product owners.
• Leverage Business Process Consultants, Solution Architects, and Technical Consultants to synthesize requirements, drive epic and user story creation, and commence development.
• Act as a liaison between project teams to facilitate design decisions, remove blockers, and maintain execution velocity.
• Manage stakeholder engagement and executive communications with CISOs and SOC/incident response leaders, facilitating decisions, change control, and status reporting with clear KPIs, value realization, and adoption metrics.
• Guide stakeholders through the transition from current-state processes and tools to ServiceNow-aligned architecture, including migration approach, customization decisions, sequencing, and change impact, in partnership with architects.
• Engage with internal and client-facing PMO teams, delineating responsibilities and aligning status reporting for risks, actions, issues, and dependencies.
• Lead implementation planning, including cutover from legacy case management or SOAR tools, training direction, and User Acceptance Testing preparation.
• Orchestrate cross-functional teams and vendors across onshore and offshore models, aligning resources and mitigating delivery risks, blockers, and interdependencies.
• Lead, staff, and develop Consultants and Senior Consultants, setting quality standards and coaching for growth.
• Oversee pre-sales through delivery handoff, including scoping, estimates, staffing plans, delivery approach, and transition-to-operations readiness.

Requirements & Tech Stack

• ServiceNow
• SecOps
• SIR
• TISC
• SOAR tools
• SIEM
• Now Assist for Security Operations
• Performance Analytics
• NIST 800-61, NIST CSF, ISO 27001, MITRE ATT&CK frameworks

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Security, Engineering, Information Technology, or Business Administration.
• ServiceNow Certified System Administrator (CSA).
• 6+ years managing or acting as a business process consultant on ServiceNow programs or projects in a client-facing consulting or professional services role.
• 6+ years leading or acting as a business process consultant in multi-workstream ServiceNow deliveries using Agile or hybrid methodologies, including backlog, sprint, and release management.
• 4+ years managing program financials, executive reporting, stakeholder management, and change control.
• 3+ years managing distributed delivery teams, including onshore and offshore resources, vendors, and client personnel.
• Experience guiding client leadership through migration from legacy tools and processes to ServiceNow-aligned architecture and best practices.
• 2+ full lifecycle ServiceNow SIR implementations delivered from initiation through go-live and transition to operations.
• Ability to travel 50%, on average.
• Limited immigration sponsorship may be available.

Preferred

• 3+ years delivering ServiceNow Security Incident Response programs.
• ServiceNow Certified Implementation Specialist - Security Incident Response (CIS-SIR).
• ServiceNow Certified Application Developer (CAD).
• ServiceNow Certified Technical Architect (CTA) or Certified Master Architect (CMA).
• Experience leading a SOC platform consolidation or SOAR migration.
• Understanding of high usage SIEM / SOAR tools, as well as market trends.
• Experience with Threat Intelligence Security Center (TISC).
• Experience applying NIST 800-61, NIST CSF, ISO 27001, or MITRE ATT&CK in operating model or platform design.
• Experience delivering Now Assist for Security Operations, AI Specialists, or Performance Analytics.
• Master's degree in Computer Science, Cybersecurity, Information Security, Engineering, or Information Technology.

Skills

• Ability to work independently and collaborate as part of a team.
• Effective written and verbal communication skills.
• Meticulous attention to detail and quality of work product.
• Ability to build and sustain professional relationships.
• Ability to lead projects or workstreams.
• Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment.
• Strong interpersonal skills and professional demeanor.
• Ability to meet deadlines.
• Ability to mentor and provide clear guidance to others.