Description

A focused course, tailored for you

SecOps Workflow Design for Platform Practitioners

Build security incident and vulnerability response workflows that close the loop from detection to remediation, with framework alignment built in from the start.

Security Operations workflows that look complete in the design view but fail under real incident load, because the CMDB scope is wrong, the escalation logic is brittle, or the evidence trail is thin enough to fail an audit.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Platform practitioners running Security Operations implementations hit the same wall: the workflow passes UAT, the customer signs off, and then a real incident exposes the gaps. CMDB coverage that missed a critical CI class. SLA policies that escalate to the wrong group at 4am. Vulnerability response records that close without a verified remediation step. Each gap is fixable in isolation, but the underlying problem is architectural: the workflow was designed around the platform's default objects, not around the actual incident lifecycle the customer's security team runs. This course teaches the design logic that prevents those gaps, not just the configuration steps that patch them after the fact.

What you walk away with

Define CI scoping logic that captures the full asset universe relevant to security incident triage.
Build escalation policies that survive real incident patterns, including out-of-hours, multi-group, and major-incident paths.
Map MITRE ATT&CK tactic stages to workflow states so the platform timeline matches what a threat analyst actually reads.
Integrate threat intelligence feeds into the prioritisation layer without breaking the workflow's SLA structure.
Produce the audit evidence package an ISO 27035 or NIST CSF review requires directly from workflow data, without manual reconstruction.
Validate vulnerability response closure with a verified remediation step that satisfies both the workflow record and the customer's CISO.

The 12 modules

Module 1. Scoping the CI Universe for Security Incident Triage

Most SecOps workflow failures trace back to CMDB scoping decisions made at the start of implementation. This module covers how to define CI classes, relationship types, and tag logic that capture the full asset surface a security incident can touch, including shadow assets, cloud-native resources, and third-party integrations. You will build a scoping matrix you can validate with the customer before the first workflow state is configured.

Module 2. Incident State Design: Lifecycle First, Platform Second

The platform's default Security Incident states are a starting point, not a design. This module teaches how to map the actual incident lifecycle your customer's SOC team runs, identify the decision points where workflow state must change, and then configure the platform to reflect that lifecycle rather than retrofit the SOC around the platform's defaults. Includes worked examples for three common SOC operating models.

Module 3. Mapping MITRE ATT&CK Stages to Workflow States

Customers and their security teams read incidents through ATT&CK tactic and technique lenses. When the workflow state timeline does not align with that language, the platform record loses credibility as an investigation artefact. This module covers how to create a state-to-tactic mapping, implement it as workflow metadata, and produce a timeline view that a threat analyst can use without translation.

Module 4. SLA Policy Design for Real Escalation Patterns

Default SLA policies break under out-of-hours incidents, multi-team escalations, and major-incident declarations. This module teaches how to model the escalation paths the customer actually uses, build SLA policies that account for those paths, and configure pause and reset logic that survives the edge cases. You will also build an SLA audit trail that distinguishes a legitimate pause from a workflow error.

Module 5. Assignment Group Logic That Fires Correctly

Assignment failures are often invisible until an incident is already overdue. This module covers how to design assignment group logic using CI attributes, incident category, severity, and time-of-day conditions, how to test that logic against realistic incident scenarios before go-live, and how to build a fallback path that routes to a human when no automated assignment matches.

Module 6. Vulnerability Response: Closure That Actually Means Closed

Vulnerability response records that close without a verified remediation step are one of the most common audit findings against SecOps implementations. This module covers how to build a closure workflow that requires remediation evidence, integrates with patch management records, and produces a closure artefact a CISO can present to auditors. Includes the remediation verification checklist your customers can adapt to their own patch cycles.

Module 7. Integrating Threat Intelligence Into the Prioritisation Layer

Threat intel feeds are only useful when they change what the workflow does, not just what it displays. This module covers how to ingest threat intelligence data into the prioritisation layer, write scoring logic that adjusts incident severity based on active threat campaigns, and configure alerting thresholds that distinguish signal from noise. You will build a prioritisation model the customer's threat team can tune without a platform admin.

Module 8. Building the ISO 27035 Evidence Package From Workflow Data

ISO 27035 requires an incident record that covers detection, triage, containment, eradication, and recovery, with timestamps and accountable parties at each stage. Most SecOps workflows capture this data but do not surface it in the format a reviewer needs. This module covers how to structure workflow fields and activity log entries so the ISO 27035 evidence package can be generated directly from the platform record without manual reconstruction.

Module 9. NIST CSF Respond and Recover Alignment

Customers under NIST CSF assessments need to demonstrate that their incident response practice maps to the Respond and Recover function outcomes. This module covers how to annotate workflow states with CSF subcategory references, produce a function-level evidence summary from incident data, and identify the workflow gaps that typically cause assessors to flag Respond and Recover as partially implemented.

Module 10. Designing for the Post-Incident Review

The post-incident review is where workflow quality becomes visible to the customer's leadership. This module covers how to design the workflow so the post-incident record is complete without requiring the analyst to reconstruct the timeline after the fact, how to configure the lessons-learned capture, and how to produce the executive summary a customer's CISO needs to present to the board without editing the raw workflow record.

Module 11. Handoff Workflows: SecOps to GRC, Legal, and HR

Security incidents that involve data exposure, insider threat, or regulatory breach trigger handoffs to GRC, Legal, and HR that most SecOps workflows do not handle gracefully. This module covers how to design handoff workflows that preserve the incident record's integrity, notify the right parties at the right stage, and produce the regulatory disclosure timeline a privacy or compliance team needs without duplicating the incident record.

Module 12. The Implementation Playbook: From Design Review to Customer Sign-Off

Bringing together the architectural decisions from modules 1 through 11, this final module walks through the design review process a customer's security leadership team expects, the acceptance criteria that distinguish a production-ready workflow from one that passed UAT, and the ongoing health checks that catch configuration drift before the next major incident exposes it. You will leave with a design review template you can use on every future implementation.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Modules 1-3 address the scoping and state design decisions that determine whether the workflow captures the incident correctly from the first alert.

Modules 4-6 address the operational reliability problems: SLA failures, assignment errors, and closure records that do not hold up under audit.

Modules 7-9 address the framework alignment work that makes the platform record credible to threat analysts, ISO reviewers, and NIST assessors.

Modules 10-12 address the handoff, review, and sign-off processes that determine whether the customer's leadership trusts the platform as their incident record of truth.

What you get with this course

12 written modules covering SecOps workflow design from CI scoping through post-incident review
Downloadable templates for each module: CI scoping matrix, state-to-tactic mapping, SLA audit trail, remediation verification checklist, ISO 27035 evidence package structure, NIST CSF respond/recover annotation guide, design review template
Hand-built implementation playbook tailored to the Security Operations practitioner role, delivered alongside course access
Worked examples for three common SOC operating models across the state design module

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Before and after

Before

Workflows that pass UAT and fail under real incident load. Audit findings on closure records. SLA reports that do not reflect the escalation paths the SOC actually uses. Customers who question whether the platform record is accurate.

After

A workflow design method you can apply from the scoping call forward. Closure records that satisfy ISO 27035 and NIST CSF reviewers. SLA policies that hold under out-of-hours and multi-team escalations. A post-incident review package the customer's CISO can present without editing.

What happens if you do not address this

The gaps in SecOps workflow design are invisible until an incident is already in progress or an auditor is already reviewing the record. Patching individual configuration errors after the fact is slower and more expensive than building the architectural logic correctly at the start. Customers who experience avoidable SLA breaches or audit findings against their incident records lose confidence in the platform and in the practitioners who implemented it.

Who it is for

Security Operations practitioners and implementation consultants on the ServiceNow platform who configure, maintain, or extend SecOps workflows for enterprise customers. You know the platform well. You have delivered SecOps implementations. You have also inherited incident states that do not match the workflow design, and customers who question whether the platform is actually doing what they think it is.

Who this is NOT for. Practitioners looking for introductory ServiceNow training or platform certifications. This course assumes you already work in SecOps workflow delivery and need to sharpen the architectural decisions behind the configuration.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Each module is designed to be completed in a single working session. The full course and templates take 6-10 hours depending on your pace and how much time you spend adapting the templates to your current implementation context.

Why $199 is the right number

ServiceNow's own certification paths cover platform features, not workflow design decisions. Framework training from bodies like SANS or ISC2 covers security operations theory, not platform implementation architecture. This course sits at the intersection: the design logic that translates security operations practice into workflow configuration that holds up under real conditions.

FAQ

Does this course assume a specific version of the ServiceNow platform?

The workflow design principles and framework alignment methods in this course apply across platform versions. Where specific features are referenced, the module notes which capabilities were introduced in which release family so you can assess applicability to your current deployment.

Is the implementation playbook generic or tailored to my specific context?

The hand-built implementation playbook is tailored to the Security Operations practitioner role and the implementation scenarios most common in that context. It is designed to be adapted to your specific customer environment, not used as a generic checklist.

What if I have a question about a specific module after completing the course?

Reply to the course confirmation email with your question and the relevant module number. Gerard responds by reply, typically within one business day.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.