Pros
The incident response work itself can be technically engaging at times, and there are capable people at the individual contributor level who genuinely care about the work.
Cons
As an Incident Response Analyst at ServiceNow, my experience has been defined by two major shortcomings that made it difficult to stay motivated or see a future with the company: virtually no opportunity to learn or grow, and a leadership team that is constantly at war with itself over politics rather than focused on running an effective organization. On the learning side, the role is far more static than it is advertised. You are expected to handle incidents, follow the same processes repeatedly, and deliver results, but there is almost no investment in helping analysts develop beyond what they already know. Training budgets are thin, mentorship is nonexistent in any meaningful sense, and access to new tooling, methodologies, or cross-functional exposure is minimal. If you are early in your career and hoping to build depth in incident response or adjacent security domains, this environment will actively hold you back rather than push you forward. The leadership culture is arguably the bigger problem. Senior leaders are visibly and openly at odds with one another, and that tension constantly filters down to the people doing the actual work. Priorities shift frequently, not because the business demands it, but because different leaders are pulling in different directions and the team ends up caught in the crossfire. There is a noticeable disconnect between what leadership says and what is actually happening operationally, and this creates a credibility gap that is hard to ignore. The political atmosphere rewards those who are good at self-promotion and alliance-building over those who are simply good at their jobs. But you will be ****ed over if a new leader doesn't like you. Bottom line: the work itself can be interesting, but the environment surrounding it makes it very hard to thrive here.