Security Operations Training – Determining What’s Right for Your Role

Learning Paths and Courses 

The learning paths designed to support success in implementing Security Operations applications includes several types of courses:  

• Prerequisites 
• Product Line Specific 

• Additional Recommended  

Courses also have more than one type of presentation. Instructor-led Training courses have an associated cost, while On Demand courses are free. All ServiceNow courses are available in Now Learning. 

There are 2 full Learning Paths for Security Operations. You can view and enroll in the paths by clicking on them below: 

• Security Incident Response (SIR) Implementer Path (represented as item 2a in the image below) 
• Vulnerability Response (VR) Implementer Path (represented as item 2b in the image below) 

The SIR and VIR courses within these paths can be completed in any order, relative to one another. You can also opt to complete one and not the other (this will result in completion of only the corresponding path for that course).  

Note that both paths include the same prerequisites (left side of product line) and additional recommended courses (right of product line), as well as the Security Operations Fundamentals course (represented as item 1). 

Image Source: Learning Paths  

Prerequisites:  

• The courses listed to the left of the Select Product Line graphic are considered prerequisites to any Product Line specific portion of a ServiceNow learning path.  
• The same prerequisites are listed for all Implementer learning paths. Prerequisites do not have to be repeated to complete subsequent learning paths with the same prerequisites. 

Product Line Specific: 

• All product line specific fundamentals courses are designed to build upon core concepts and basic platform functionality taught in the prerequisite series of courses. 
• All product line specific implementer courses are designed to build upon core concepts and basic product functionality taught in the product line specific fundamentals courses that precede them. 

Additional Recommended: 

• Additional recommended courses are often available as part of a learning path. They may be specific to the same product line, different product lines packaged together, or a combination of both.  
• Like prerequisites, additional recommended courses do not have to be repeated to complete subsequent learning paths with the same additional recommended courses. 
• Depending on your product line, there may be additional recommended courses that do not appear on the official learning path. These can be located by navigating to Now Learning and using the Product filter to select the product line; this will display all courses of all types associated with that product line (both on and off the official learning path).  

Certifications & Micro-Certifications: 

• Courses may be associated with a Certification or Micro-Certification. Basic information about ServiceNow’s Certification Program can be found here: ServiceNow Certification Program FAQ 
• If a course includes a voucher for taking a certification exam, a learner should carefully review the exam blueprint for that exam before attempting it. In addition to the course that the voucher is attached to, there are a number of additional courses, study materials, and practical experience recommended as preparation steps for each exam. You can view the exam blueprints for Security Operations exams here: 

• Certified Implementation Specialist – Security Incident Response (CIS-SIR) Exam Blueprint
• Certified Implementation Specialist – Vulnerability Response (CIS-VR) Exam Blueprint

With this overview of Click the name of any course in the table below to visit its page on Now Learning, see a course description, enroll (On Demand) or see available dates and prices (Instructor-led). A list of upcoming Instructor-led courses can also be viewed here. 

* Additional Recommended course is relevant to the product line but is not part of the official learning path. In the Security Operations path, courses like these are launched periodically between ServiceNow releases. We recommend checking back at least quarterly for new courses like this from the Security Operations curriculum team.  

Additional Resources: 

The paths and courses in Now Learning are the core of what is needed to be successful in learning the products for all roles and functions. However, there are a number of other places to look for free, on demand resources across the ServiceNow sites.   

Community:  

This article is posted in the Security Operations Community, where additional discussions, resources, events, blogs, etc. can be found and registered for or subscribed to individually. Subscribing to the forum itself ensures notifications are generated when any type of new Security Operations Community content is posted. 

Demo Center: 

Live demonstrations and technical conversations are hosted daily by ServiceNow Solution Consultants. Click here to visit the Demo Center for Security Operations, to register for upcoming webinars or view recordings of previously held webinars.  

YouTube: 

Short, easily digestible videos featuring overviews, demos, and tutorials are available on ServiceNow’s YouTube channel. Videos may focus on concepts, products, specific features, etc. Curated playlists feature recommended groupings of similar topics. View the Security Operations playlist by clicking Getting Started with Security Operations. 

Developer Site: 

The training on the Developer site is not Security Operations specific, it does feature topics which may be helpful to a Security Operations team. The Learning Plans section of the developer site groups courses by the role and function of the learner. 

Product Documentation: 

Like the Community site, this features in-depth written information about the products, features, and functionality of ServiceNow; topics can be subscribed to so that notifications are received when new or updated content is published. However, this site features only content authored by ServiceNow. Navigate to the latest Product documentation for Security Operations; note that the documentation is searchable by keyword and results are filterable by release/version.