Security Engineer - Automation

eBay's Threat Management and Response (TMR) organization protects its global platform and users from evolving cyber threats. The TMR Security Engineering team is expanding its ServiceNow Automation implementation to enhance automation, data integration, and response efficiency. This role seeks a ServiceNow Developer – Security Operations to design, build, and maintain ServiceNow-based security workflows, leveraging SecOps modules (SIR, VR, TI) to streamline processes, automate responses, and integrate with existing enterprise security platforms for the global Cyber Security Incident Response Team (CSIRT) and Vulnerability Management programs.

Must Have

• Design, develop, and implement ServiceNow SecOps modules (SIR, VR, TI, and Event Management).
• Build and maintain automated workflows, UI policies, business rules, and script includes.
• Develop REST/SOAP integrations with tools such as Splunk, CrowdStrike, Qualys, Salesforce, and BMC Remedy.
• Develop custom dashboards and Performance Analytics to track security metrics and incident response performance.
• Implement enhancements in the Service Portal to improve usability for security teams.
• Maintain the reliability, scalability, and security of the ServiceNow platform.
• Partner with Security Engineering, CSIRT, and Vulnerability Management teams to align workflows with operational needs.
• Troubleshoot issues, perform root cause analysis, and ensure high availability of production environments.
• Contribute to continuous improvement initiatives for security automation and incident management.
• 5+ years of software development experience using JavaScript, AngularJS, HTML, CSS, and AJAX.
• 1+ years of experience as a ServiceNow Developer and Administrator.
• Hands-on experience with ServiceNow Security Operations (SecOps) modules.
• Good understanding of ServiceNow scripting, integrations, and architecture.
• Experience developing integrations using REST/SOAP APIs and working with MID Server and IntegrationHub.
• Knowledge of SQL and experience diagnosing data-related performance issues.
• Familiarity with source control tools (GIT, Maven) and UNIX shell scripting.
• Ability to design and execute unit, integration, and regression tests.
• Strong problem-solving skills and ability to work cross-functionally within technical and non-technical teams.

Good to Have

• ServiceNow Certified System Administrator (CSA)
• ServiceNow Certified Implementation Specialist – SecOps
• ServiceNow Certified Application Developer (CAD)
• Knowledge of cybersecurity frameworks (NIST 800-61, MITRE ATT&CK, ISO 27001).
• Experience integrating ServiceNow with SIEM, SOAR, or Threat Intelligence platforms.
• Exposure to enterprise-scale incident management or SOC environments.

Perks & Benefits

• Target bonus
• Restricted stock units
• Medical benefits
• Financial benefits
• 401(k) eligibility
• Paid time off (PTO)
• Parental leave

At eBay, we're more than a global ecommerce leader — we’re changing the way the world shops and sells. Our platform empowers millions of buyers and sellers in more than 190 markets around the world. We’re committed to pushing boundaries and leaving our mark as we reinvent the future of ecommerce for enthusiasts.

Our customers are our compass, authenticity thrives, bold ideas are welcome, and everyone can bring their unique selves to work — every day. We're in this together, sustaining the future of our customers, our company, and our planet.

Join a team of passionate thinkers, innovators, and dreamers — and help us connect people and build communities to create economic opportunity for all.

About the Team

eBay’s Threat Management and Response (TMR) organization is responsible for protecting our global platform and users from evolving cyber threats. We build scalable tools, automate incident response, and drive continuous improvement in our detection and response capabilities.

As part of this mission, the TMR Security Engineering team is expanding its ServiceNow Automation implementation to enhance automation, data integration, and response efficiency across the enterprise.

About the Role

We are seeking a ServiceNow Developer – Security Operations to design, build, and maintain ServiceNow-based security workflows supporting our global Cyber Security Incident Response Team (CSIRT) and Vulnerability Management programs.

This role focuses on leveraging ServiceNow’s Security Operations suite—including Security Incident Response (SIR), Vulnerability Response (VR), and Threat Intelligence (TI) modules—to streamline processes, automate responses, and integrate with existing enterprise security platforms.

The ideal candidate is an experienced ServiceNow developer with deep knowledge of security operations, automation, and enterprise integrations.

What You’ll Do

• Design, develop, and implement ServiceNow SecOps modules (SIR, VR, TI, and Event Management).
• Build and maintain automated workflows, UI policies, business rules, and script includes.
• Develop REST/SOAP integrations with tools such as Splunk, CrowdStrike, Qualys, Salesforce, and BMC Remedy.
• Develop custom dashboards and Performance Analytics to track security metrics and incident response performance.
• Implement enhancements in the Service Portal to improve usability for security teams.
• Maintain the reliability, scalability, and security of the ServiceNow platform through regular patching, upgrades, and configuration management.
• Partner with Security Engineering, CSIRT, and Vulnerability Management teams to align workflows with operational needs.
• Troubleshoot issues, perform root cause analysis, and ensure high availability of production environments.
• Contribute to continuous improvement initiatives for security automation and incident management

What You’ll Bring

• 5+ years of software development experience using JavaScript, AngularJS, HTML, CSS, and AJAX.
• 1+ years of experience as a ServiceNow Developer and Administrator.
• Hands-on experience with ServiceNow Security Operations (SecOps) modules.
• Good understanding of ServiceNow scripting, integrations, and architecture (Business Rules, Script Includes, Flow Designer, Transform Maps).
• Experience developing integrations using REST/SOAP APIs and working with MID Server and IntegrationHub.
• Knowledge of SQL and experience diagnosing data-related performance issues.
• Familiarity with source control tools (GIT, Maven) and UNIX shell scripting.
• Ability to design and execute unit, integration, and regression tests.
• Strong problem-solving skills and ability to work cross-functionally within technical and non-technical teams.

Preferred Qualifications

• ServiceNow Certified System Administrator (CSA)
• ServiceNow Certified Implementation Specialist – SecOps
• ServiceNow Certified Application Developer (CAD)
• Knowledge of cybersecurity frameworks (NIST 800-61, MITRE ATT&CK, ISO 27001).
• Experience integrating ServiceNow with SIEM, SOAR, or Threat Intelligence platforms.
• Exposure to enterprise-scale incident management or SOC environments.