thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Home › Courses › ServiceNow › ServiceNow Certified Implementation Specialist - Security Incident Response (CIS-SIR)
ServiceNowSNCISSIR

ServiceNow Certified Implementation Specialist - Security Incident Response (CIS-SIR)

We do not teach just for the test.Worked examples and real discussion, not a question bank. The exam is then delivered in the classroom — 98% pass it first time.
$3,420catalog price — your starting point
thinQflex™Tell us what you would like to pay for this class — in full, or across twelve monthly payments.
Next date
  • 30 Nov 2026Sterling, VA
Make your offerCourse datasheet (PDF)
4 daysconsecutive days
Live onlineor in the classroom
ProfessionalSecurity Operations
40% labs60% lecture
24 monthsfree retakes

Course overview

Download the course datasheetThe full outline for ServiceNow Certified Implementation Specialist - Security Incident Response (CIS-SIR), as a PDF.
thinQtank® Learning is offering a unique four-day training camp comprised of four days of instructor-led learning that gives students the knowledge and skills needed to implement ServiceNow Security Incident Response: Security Operations fundamentals, security incident creation and threat intelligence, integrations, incident management, risk calculations and post-incident response, and automation with playbooks.

The camp follows the exam outline ServiceNow publishes for this certification, with hands-on work in a ServiceNow Personal Developer Instance (PDI) throughout. CIS-SIR validates Security Operations skills for incident response and requires CIS - Data Foundations.

ServiceNow and Now Platform are trademarks of ServiceNow, Inc.

This course prepares students to take the ServiceNow CIS - Security Incident Response exam.

What's included

13 items
thinQtank® Learning Accelerated Custom Exam Study Guide for the ServiceNow CIS - Security Incident Response exam
Hands-on lab guide for a ServiceNow Personal Developer Instance (PDI)
Custom and focused exam preparation software and materials
Course specific thinQtank® Learning publications to promote a fun and exciting learning
Membership to the thinQtank® Learning University Online
WE DO NOT "TEACH THE TEST" - Students will receive valuable examples and discussion
All courses taught by experienced ServiceNow-certified practitioners
Additional hours of remote lab access
Custom video recordings with even more in-depth learning of course topics
Customized practice exam software
Digital courseware
Retake any or all portions of the course as many times as you like in person or live on-line for 24 months
Six months mentoring access to our engineers after completing the course

What you'll be able to do

12 objectives
  • Create and work security incidents
  • Configure threat intelligence and security tool integrations
  • Manage the security incident lifecycle
  • Calculate risk and run post-incident reviews
  • Automate response with playbooks and flows
  • Visualize SIR data on dashboards
  • SIR Overview and Data Visualization: SIR workspace; dashboards; personas
  • Security Incident Creation and Threat Intelligence: Incident creation paths; threat intelligence; observables
  • Security Incident and Threat Intelligence Integrations: SIEM and EDR integrations; enrichment; email parsing
  • SIR Management: Lifecycle and assignment; response tasks; collaboration
  • Risk Calculations and Post Incident Response: Risk scoring; post-incident review; reporting
  • Automation and Standard Processes: Playbooks; Flow Designer; NIST-based processes

The exam

90minutes to complete
  • ServiceNow CIS - Security Incident Response
  • Exam fee set by ServiceNow: $450 USD per attempt (retakes $225)
  • ServiceNow does not publish a passing score - we work to the official exam blueprint
  • Exams are scheduled through ServiceNow University and taken online proctored or at a testing center - we help you schedule your attempt

Who it's for, and what you need first

Target Audience

  • SOC analysts and incident responders
  • ServiceNow technical consultants and administrators
  • Security implementation and operations managers
  • Service members, veterans and military spouses using AF COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0

Prerequisites

  • ServiceNow CIS - Data Foundations (required by ServiceNow)
  • Platform implementation knowledge recommended

How it's delivered

Instructor-Led Training
Immersive Live-Online Training
On-Site and Custom Delivery

Dates and locations

21 scheduled
Guaranteed to run means the class goes ahead whatever the enrollment.
Prices shown are MSRP. Qualified military personnel funding through Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0 pay a flat $1,500 per class, whatever the listed price. Everyone else — call 855-868-4467 about group pricing, discounts and current promotions.