> Markdown version of [/jobs/ext/4706027-principal-software-engineer-architect-cyber-defense-engineering](https://www.wearedevelopers.com/jobs/ext/4706027-principal-software-engineer-architect-cyber-defense-engineering). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Principal Software Engineer & Architect, Cyber Defense Engineering

- **Company:** ServiceNow
- **Location:** Santa Clara, CA, United States (Remote available)
- **Experience:** Experienced
- **Salary:** $221,200
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), Artificial Intelligence, Audit Trail, Code Review, Cyber Security, Continuous Integration, Data Infrastructure, Data Security, Intrusion Detection and Prevention, Python (Programming Language), Machine Learning, Role-Based Access Control, Cloud Services, Security Information and Event Management, Software Engineering, SQL Databases, Policy as Code, Model Validation, Generative AI, Agentic-AI, Information Technology, Cyber Warfare, Software Version Control, Servicenow
- **Published:** November 13, 2026
- **Apply:** https://jobs.smartrecruiters.com/ServiceNow/744000161415577-principal-software-engineer-architect-cyber-defense-engineering

## About the Role

* Bachelor's degree in computer science, software engineering, or a similar field.
 * 10+ years of software engineering experience, with 3+ years in a principal, staff, or architect role.
 * Proven experience designing and operating large-scale cloud data platforms in production, including data modeling, data warehouse design, and high-volume streaming and batch telemetry pipelines across multiple systems.
 * Hands-on ML/AI experience, including shipping ML or LLM-based systems to production, and working knowledge of how data quality, freshness, and lineage limit model performance.
 * Proficiency in SQL and at least one general-purpose language (Python, Go, or Java).
 * A record of setting technical direction across teams without formal authority.
 * Clear, concise writing and a habit of documenting decisions and their rationale., * Experience applying ML and graph-based analysis to security problems, such as anomaly detection, entity correlation, incident investigations, or attack path analysis.
 * Experience in security operations, such as SIEM platforms, security datalakes, detection engineering, or incident response.
 * Knowledge of secure data access patterns such as RBAC/ABAC, masking, and policy-as-code.
 * Advanced degree in machine learning, AI, or a related field.

## Description

As Principal Software Engineer & Architect, you will own the technical direction of the data and platform systems behind detection, investigation, hunting, response, and AI-driven defense. Several engineering teams will build against your architecture, and your decisions will show up in measurable security outcomes.

What You'll Do

 * Own the architecture of our multi-system security data platform, from ingestion to access, including the data that powers detection, investigation, hunting and risk analytics. Decide what data lives where, weighing business value, performance, retention, and cost, and remove duplication across systems.
 * Define shared schemas, data models, and data contracts so telemetry from different sources is consistent, trustworthy, and joinable for both people, automation and AI.
 * Build the data foundation for applied AI in security operations: data and feature pipelines, model evaluation, retrieval, and governed data access for AI agents that investigate and respond to threats.
 * Build access control, data protection, auditability, and compliance into the architecture so the platform is secure by design.
 * Lead technical design across teams, resolve tradeoffs on shared platforms, and keep the architecture coherent as the organization grows. Drive major decisions to closure through design and decision documents.
 * Set engineering standards for source control, CI/CD, testing, and observability. Mentor engineers through design and code review.
 * Tie platform investments to measurable outcomes: detection coverage; time to detect, investigate, and mitigate; data quality and freshness; and more., We approach our distributed world of work with flexibility and trust. Work personas (flexible, remote, or required in office) are categories that are assigned to ServiceNow employees depending on the nature of their work and their assigned work location. Learn more here. To determine eligibility for a work persona, ServiceNow may confirm the distance between your primary residence and the closest ServiceNow office using a third-party service.