×

Author: Dan Wells

ServiceNow to TCS: the offers are in, and here’s what’s in them

Posted on by Dan Wells

A $22,550 a year pay cut, presented as a $5,000 pay rise.

That’s what one affected ServiceNow consultant worked out when they sat down with the TCS offer and did the maths properly. They sent me the numbers. I’ll get to them.

First, some context on how I ended up with a full inbox.

Last week I wrote about something I’d read on Reddit. Nothing more than that. No inside source, no tip-off, just a post I couldn’t verify and a question about whether anyone else was hearing the same thing.

Since then I’ve had messages from people in the UK, Ireland, Germany, Spain, Australia and North America. Almost every one of them asked to stay anonymous. One messaged me from a brand new LinkedIn account because they’d been told the whole thing was confidential and didn’t want to leave any written evidence.

There is still nothing in the trade press. No announcement from ServiceNow, no announcement from TCS. The TCS and ServiceNow partnership release from February talks about co-innovation labs and AI workflows. It says nothing about several hundred people changing employer.

So this is what I’ve been told by the people it’s happening to. Names out, everything else as close to their words as I can keep it.

How people found out

The UK version, from someone who sat through it. Invited into a call with about two hours’ notice. All other attendees hidden. Webinar format, so nobody could comment and nobody could see anyone except the speaker. A pre-written statement read out. Then it was over.

Later that day, an email about the TUPE process and a request to elect a couple of representatives for consultation. An FAQ was attached. The person who read it described it as clarifying things very ambiguously, and said they couldn’t tell whether that was deliberate.

Germany got an ad hoc 30-minute meeting, a transfer date of 1 November, and nothing in writing for days afterwards. A verbal announcement, some high-level detail on pay and benefits, and an HR contact.

North America: around 30 people in one department, mostly HRSD.

One person summed up the whole experience in a line. Nobody gave us a sales pitch. It was just a case of us no longer being required, so this is now your new employer.

Where it’s happening

IC4 and below, with some areas excluded that are considered more complex or less routine.

UK, Ireland, Germany, Australia, Spain and North America have all been confirmed to me directly. Everyone I’ve spoken to believes it’s worldwide.

TCS in EMEA, Tech Mahindra in AMS, according to one person in the UK. I still can’t confirm the split independently.

Spain has a twist. Someone told me TCS approached them about a new role working directly at the ServiceNow office. So while one group is being moved out, TCS is hiring into the same building.

Three different reasons, from the same company, in the same fortnight

In the UK, staff were told their roles are now routine enough that ServiceNow no longer needs to provide the service itself, and that TCS has been selected as the best partner to take over.

In North America, they were told demand for HR workflow products has dropped.

Then, in a follow-up benefits meeting, the ServiceNow lead opened by giving a third reason. He put the decision down to the CEO’s commitment to keep headcount flat.

That’s the one I’d pay attention to, because it’s the only explanation that fits the numbers.

Q2 revenue was $3.99bn, up 24% year on year. Subscription revenue up 24.5%. Full year subscription guidance was raised to around $15.77bn. This is a company that has spent roughly $9bn on acquisitions this year, including $7.75bn on Armis.

Nobody is making this decision because the money isn’t there.

The line that stayed with me

One person in the HRSD team wanted to correct something I’d written. I’d said ServiceNow had decided it didn’t need these people any more.

Not so, they told me. In the initial meeting it was stressed repeatedly that nothing would really change. Same projects, same colleagues, same laptops. The only difference is who signs the payslip.

Their view: that’s worse than being told you’re surplus.

They do need us, they said. They just don’t want to pay us our RSUs or give us access to things like the employee stock purchase discount.

What’s actually in the offers

Now the numbers.

One person sent me their full comparison. Base salary at ServiceNow was $185,000, with a bonus target of $27,750 and equity vesting at roughly $28,300 a year. Total package around $241,050.

The TCS offer: base $190,000, bonus target $28,500, equity $0. Total $218,500.

A $5,000 rise on base. A $22,550 a year cut on total compensation.

The equity figure isn’t a projection or a stock price bet. It’s $99,000 of already-granted, unvested RSUs spread across the three and a half years left on the vest. That’s what walking away from ServiceNow costs them, and no part of the TCS offer replaces it.

On top of the base there’s a $2,000 signing bonus and a retention bonus worth about 10% of salary, paid in two halves at month six and month twelve. For this person that’s $18,500. Half of it isn’t real money on day one, because the second $9,250 doesn’t arrive until month twelve and they lose it if they hand in notice before then.

Everyone this person has compared notes with has been given the same shape of offer. A small rise on base, a similar bonus, a signing bonus, a retention payment, and nothing at all for the equity.

Other things that have come back to me:

People in the US have been told only vested RSUs are available to them. Everything unvested goes.

Some job titles are changing. One person went from Senior Technical Consultant to Senior Business Consultant, which they described as a non-starter.

The deadline is four days in most cases. One person was told they had until Monday to sign, and by the Friday still hadn’t been given the offer, the salary or the benefits detail.

When someone asked on the call what the severance would be if they declined, the answer made it sound like there wouldn’t be any.

Why there’s no payout option, and why that isn’t an oversight

This is the part I think matters most, because most of the anger sent to me is about the absence of a choice.

Under TUPE, if you object to transferring, your contract terminates and you aren’t treated as having been dismissed. You can refuse, but you generally can’t claim redundancy pay or unfair dismissal. Your employer treats it as a resignation. That’s regulation 4(8), and it’s why the move-or-resign framing people are describing is legally accurate rather than a threat somebody invented in a meeting.

There’s one exception. If the transfer involves a substantial change in your working conditions to your material detriment, regulation 4(9) lets you treat the contract as terminated and be treated as dismissed. That’s a real route. It’s fact-specific, and it’s exactly the sort of thing to take proper advice on rather than a view from a recruiter.

A total compensation drop of that size, and a title change, are the kind of facts that get looked at under 4(9). I’m not going to tell you they’d succeed. I am going to tell you they’re worth putting to an employment solicitor before you sign anything.

The headline still stands. This is a lawful way to move several hundred people out of a business without writing redundancy cheques. Whether it’s the right way is a different question, and it’s the one people are furious about.

The RSU question nobody has answered

Nobody in the UK, Germany or North America has been given a clear answer on what happens to unvested equity.

Here’s the one useful thing I can add, for the UK at least.

In Ponticelli UK Ltd v Gallagher, the Court of Session held that the right to take part in an employer’s share plan can transfer under TUPE even where that right sits outside the employment contract. Where the new employer can’t replicate the plan, and TCS obviously can’t hand anyone ServiceNow stock, the employee is entitled to a scheme of substantial equivalence. That follows MITIE Managed Services v French.

What substantially equivalent means in practice isn’t defined and gets argued case by case. It might be a different plan, it might be cash.

But the starting position is not that your equity disappears because the new employer doesn’t do equity. If you’re in the UK and heading into consultation, put that question to your representatives in writing and get the answer in writing too.

On “protection plus one day”

Several people have told me the same fear. That TUPE protection runs for a set period and they’ll be let go the day after it expires.

That isn’t how it works. There’s no fixed window ticking down.

A dismissal is automatically unfair where the sole or principal reason is the transfer. It isn’t where there’s an economic, technical or organisational reason involving changes in the workforce. Redundancies after a transfer are permitted on that basis.

So the protection isn’t a countdown clock, but it isn’t a shield either. What matters is the reason given, and the further you get from the transfer date, the easier it becomes to argue the reason is something else.

I’d rather people worried about the right thing than the wrong one.

What people inside TCS think

Two things came back from the other side, and neither is comfortable.

Someone with a long history at TCS, including work on the original alliance, told me they expect the transferred group to be moved out reasonably quickly and replaced with offshore roles or AI. That’s an opinion, not a fact, and I’m reporting it as one.

Separately, someone in the market raised the more immediate problem. The transferring group arrives as expensive resource compared with the bench already sitting at that grade. That’s an issue for the people already at TCS as much as the ones moving.

What I’d say if you’re affected

Don’t sign on day four because day four is the deadline. Ask for the deadline to be extended in writing. Ask what’s happening to your unvested equity, in writing. If your title is changing, ask why, in writing.

Get the consultation representatives to ask the questions you don’t want your name attached to. That’s what they’re for.

And then, separately from all of that, work out what you actually want. Because the ServiceNow market right now is not short of options for people with genuine delivery experience on the platform.

I’ve spent the last week talking to people who assumed that leaving ServiceNow would mean a step down. It doesn’t. Partners and end customers are paying properly for exactly this profile, and a lot of them would take a call from an ex-ServiceNow Expert Services consultant tomorrow.

What this does to ServiceNow as a place to work

Up until June, almost every ServiceNow professional I spoke to described the vendor as the place they wanted to end up.

That has changed a long way in three months, and I don’t think it changes back quickly. One person put it better than I can. It was a matter of pride to work for ServiceNow, and they feel that bridge has been burned.

There’s a version of this where ServiceNow was out of money and out of options. That version isn’t true. The business is performing. The company chose a route that doesn’t require it to pay anyone out, headcount finishes the year where it started, and several hundred people become somebody else’s payroll.

That’s a decision. It’s worth being honest about it as one.

Still asking

The questions that are still open.

If you’ve now seen a TCS or Tech Mahindra offer, what’s in it where you are? What’s been said about unvested RSUs in your country? And if you’re outside the UK, Ireland, Germany, Spain, Australia and North America, is this happening to you too?

Drop me a message. Names stay out of it, as they have all week.

If you’ve been affected and you want a straight conversation about what’s out there rather than a sales pitch, that’s what we do. We’ve been recruiting in the ServiceNow ecosystem for years and we know who’s hiring.

Get in touch with the Linking Humans team at www.linkinghumans.com, or take a look at our ServiceNow World Forum London guide if you’re going to be there.

ServiceNow World Forum 2026: Every Date, City and Venue

Posted on by Dan Wells

ServiceNow World Forum runs in nine cities in 2026. Two have already been, seven are still to come, and every one of them is free to attend.

This page is the full list with dates, venues and links. Below it, the honest answer to the question people actually ask us, which is which one is worth the day out of the diary.

Every World Forum 2026 date and city

City Date Venue Details
Sydney 30 July 2026 ICC Sydney Been and gone
New York 10 September 2026 Javits Center Been and gone
Chicago 6 October 2026 McCormick Place Event page
Mumbai 6 October 2026 Jio World Centre Event page
London 20 October 2026 ExCeL London Our full guide
Tokyo 27 to 28 October 2026 Grand Prince Hotel Takanawa Event page
Amsterdam 28 October 2026 RAI Amsterdam Our full guide
Toronto 3 November 2026 Metro Toronto Convention Centre Event page
Paris 2 December 2026 Paris Expo Porte de Versailles Our full guide

There is also a Government Forum on 25 February 2027 at the Walter E. Washington Convention Center in Washington DC. Different event, different audience, worth knowing about if you work in or sell to the public sector.

Germany is not on the list this year

Worth flagging if you are used to the old schedule. There is no Munich forum in 2026, and no German event at all. Rotterdam has gone too, folded into Amsterdam.

If you are based in the DACH region, Amsterdam on 28 October is your nearest option and it is a straightforward trip. We have written up what is on at Amsterdam including the speaker line up.

Which one should you actually go to?

They are not identical events, and the differences matter more than the marketing suggests.

If you want the biggest room and the best customer stories, go to London. It has the deepest UK enterprise line up this year, with sessions from Kingfisher, HM Revenue and Customs, Primark and Heathrow, and Louis Theroux closing the day.

If you are in Europe and can only do one, look at the calendar first. London on the 20th and Amsterdam on the 28th are eight days apart, so doing both is realistic and gives you a much better read on the year than either alone.

If you want substance over launch energy, wait for Paris. It is the last forum of the year. By December the announcements made at Knowledge in May have had six months to meet reality, so the customer sessions tell you what actually shipped rather than what was promised.

If you are technical, pick whichever one you can get to and book the labs. Every forum runs hands on sessions where you build and test your own AI agent. That hour is worth more than the rest of the day combined, and it is the same content wherever you go.

What these events tell you about hiring

We recruit in the ServiceNow market and we go to these every year, so here is the pattern we see.

What ServiceNow pushes hardest on stage shows up in the job briefs we take around two quarters later. Not by name at first. It arrives as employers asking for someone who has actually done it rather than someone who has been on the course.

This year the themes are AI Control Tower, AI agents and Workflow Data Fabric. So the people going to the labs now, building something, and able to talk about it in an interview are roughly six months ahead of the job titles. That is usually worth a band.

If you are on the hiring side, the same thing works in reverse. The people who can genuinely do this are not on the market long, and their expectations move faster than most internal salary bands do.

Our guides to the European forums

Each one has the full agenda, the speaker line up, registration and session links, and what the local hiring market looks like.

Talk to us

We recruit ServiceNow professionals and we do nothing else. If you are planning headcount for 2027, working out what a role is really worth, or wondering why your last search dragged on for months, book a call and we will tell you what we are seeing.

I will also be at London on 20 October with printed copies of the 2026 UK ServiceNow salary survey. Come and find me.

Partner or End User: Where Should You Take Your ServiceNow Career?

Posted on by Dan Wells

It comes up on nearly every candidate call I have, usually about twenty minutes in, once we’ve got past the money.

“Should I stay in consulting, or should I go in-house?”

There isn’t a right answer. There’s a right answer for you, at this point in your career. Here’s how I’d think about it, based on the hundreds of ServiceNow professionals we’ve placed on both sides of it.

Project variety

Partner side wins this one, and it isn’t close.

At a partner you might touch six or seven customers a year. Different industries, different maturity levels, different problems. One quarter you’re on a greenfield ITSM build for a retailer, the next you’re untangling a CMDB after three years of neglect. You watch a lot of organisations solve the same problem badly, which is how people get good quickly.

End user is the opposite. One platform, one set of stakeholders, one roadmap. That sounds narrower because it is. But you go deeper. You find out what happens after go-live, which most consultants never see, because they’ve moved on by month four.

Partner work builds range. End user work builds depth. Early on, range compounds faster.

Ownership

End user side, comfortably.

At a partner, you build it and you hand it over. The SOW closes, the invoice goes out, and whatever happens next is someone else’s problem. Plenty of consultants find that frustrating after a few years. You never find out whether the thing you designed actually worked.

In-house, you live with your decisions. The shortcut you took in year one shows up in year three. That’s uncomfortable, and it’s also the fastest way to learn what good architecture really means.

People who come to us wanting to move from partner to end user almost always say the same sentence: “I want to own something.”

Commercial pressure

Different kind, not more or less.

At a partner, the pressure is utilisation. Billable hours, scope creep you have to police, the awkward conversation when the customer wants something the SOW doesn’t cover. Your value gets measured weekly and everyone can see it.

In-house, the pressure is political. You’re competing for budget with every other function. You’re justifying platform spend to people who still think ServiceNow is a ticketing tool. The timeline slips because a stakeholder went quiet for three weeks and nobody is chasing them but you.

Consultants moving in-house often expect the pressure to disappear. It doesn’t. It changes shape and gets slower.

Progression and money

More nuanced than people expect.

Partner progression is structured. Consultant, senior, lead, principal, practice lead. The ladder exists, and if you’re billing well and customers ask for you by name, you climb it. Certifications count for more here too, because they’re a commercial asset the partner can sell.

End user progression is flatter. There often isn’t a role above you. If the platform owner isn’t going anywhere, neither are you, and the only answer is to move companies. In last year’s survey, 49% said they’d start looking if a promotion hadn’t happened inside twelve months. That ceiling gets noticed fast.

On money, the headline numbers are closer than the myth suggests. The difference is usually in the shape of the package. Partner side carries bonus and sometimes commission, with more variance. End user tends to be steadier, with a better pension and more predictable hours.

So which one?

Rough rule, and it holds more often than not.

First five years, go partner. You’ll see more, break more and fix more, and that’s the quickest route to being properly good.

If you want to own a platform, build a team and stop living in a delivery cycle, go end user. Just check there’s a role above you before you sign.

And if you’re going in-house purely to escape the pressure, don’t. You’re swapping it, not losing it.

This is where you come in

We’ve run the ServiceNow Salary Survey for four years now. Every year somebody asks us to break the numbers down by partner versus end user. Every year we’ve had enough responses for a solid average, but not enough to split it properly and stand behind the answer.

This year we’re fixing that. Partner versus customer is one of the four sections in the 2026 report, alongside salaries and benefits, ways of working, and culture and progression. Same questions, split by which side of the fence you sit on.

The survey is open now and it takes about five minutes. The more responses we get, the sharper that split is, and the better the answer is next time someone asks you this question over a coffee.

I want to take part in the salary survey. Click here.

Much appreciated.

Want to see what came out of last year’s? Last year’s UK average was £76,000 and the US average was $148,000, 74% had taken a pay rise in the previous twelve months, and 82% held at least one certification. The full 2025 Global report is free here: 2025 Global ServiceNow Salary Survey.

The ServiceNow Job Nobody Trained For Is The One Everybody Now Needs

Posted on by Dan Wells

In the last fortnight ServiceNow patched three vulnerabilities in its AI Platform that each scored a perfect 10.0, none of which required authentication to exploit. In the same window it expanded the AI Control Tower to govern AI across any system in the enterprise, whoever built it. I think those two events point at the same career opportunity, and at a profile the market is short of.

What happened

The advisory came out on 27 August. CVE-2026-18885 allowed arbitrary code execution. CVE-2026-18886 allowed privilege escalation through improper access control. CVE-2026-74820 was a SQL injection flaw against the underlying database. All three scored 10.0, none required authentication or user interaction, and all three were rated low complexity. A fourth, a sandbox escape, scored 8.7.

ServiceNow patched hosted instances directly and released hotfixes for self-hosted deployments across Xanadu, Yokohama, Zurich and Australia.

Separately, coverage in early September described the AI Control Tower being expanded to discover, observe, govern, secure and measure AI deployed across any system, not just ServiceNow’s own. I have not pinned the exact announcement date, so take the timing loosely. Alongside that, this year’s acquisitions tell a consistent story: Armis for asset visibility, Veza for identity governance, and Sweep, which ServiceNow confirmed as completed on 1 September, for a governance layer spanning ServiceNow, Salesforce and HubSpot.

Read those together

ServiceNow is becoming the place enterprises govern all their AI. Which makes the ServiceNow platform itself a very high-value target, and makes the person who secures it a very hard person to replace.

The role that is forming

There is a gap opening between two established professions and it does not yet have a settled job title.

Security teams own vulnerability management but frequently lack depth on the ServiceNow platform itself. Platform teams own the instance but sit inside IT service management, where security advisories are not the daily rhythm. Advisories land in the space between and both sides assume the other has it.

The people who can occupy that gap need three things at once: real hands-on platform knowledge, enough security literacy to read an advisory and work out what it touches in a specific configuration, and enough standing to force an out-of-cycle change when it matters. That is an unusual combination. My expectation is that scarcity of that kind gets priced eventually, though I am not going to pretend I can show you a published benchmark for a role that does not yet have a settled title.

It is also getting broader. When agents hold credentials and act autonomously inside your environment, they become identities that need governing like any other. The controls we built over two decades for human insider risk mostly have not been applied to them, because attention has been on the productivity gain. Somebody has to close that, and it will not be a pure security person or a pure platform person.

How to move towards it

1. Start with what you already have. If you are a platform person, you are closer to this than a security generalist is. Platform depth is the harder half to acquire. Security literacy on top of real ServiceNow experience is a shorter journey than the reverse.

2. Learn the machine identity side. The Zurich release documentation covers capability for securing machine-to-machine integrations, including the Vault and Machine Identity consoles. Check the release notes for what is in your version, then get hands-on. This is the concrete, learnable part of the agent governance problem, and it comes up far less often in conversations than the strategy layer does.

3. Read the advisories, properly. Not the headline. Go and understand which components each CVE touched and why. Doing that four times will teach you more about the platform’s attack surface than any course, and it costs nothing.

4. Build one governance story. How you handled access, auditability, or the decision not to automate something. Even small. Hiring managers are nervous about exactly this and hardly any candidate raises it unprompted.

5. Learn to talk about risk in business terms. The question that decides these interviews is some version of: an agent takes a wrong action against customer data at 2am on a Sunday, what happens? If you can answer that with a clear account of accountability, detection and rollback, you are ahead of nearly everyone.

A realistic word on timing

I am not going to tell you this is an easy pivot or that a certification unlocks it. It is a genuinely senior profile and it usually forms out of an architect or senior developer who has been pulled into governance work informally and then made it their identity.

What I will say, and I want to be clear this is my read rather than a measured finding, is that the demand side is visible in what ServiceNow is buying and building, while the supply side looks thin to me from where I sit. If that is right, it is a good window. If I am wrong about the supply side, the worst case is that you have gone deep on security and governance skills on a platform that is becoming the enterprise control plane for AI, which is not a bad place to be wrong.

If you are three or four years into ServiceNow and wondering where to go deep, this is the most defensible direction I can point you at.

Thinking about your next move? We speak to ServiceNow professionals across the UK, Europe and North America every day and we are happy to give you an honest read on your profile, whether or not you are actively looking. Start a conversation.

Sources: ServiceNow security advisory, 27 August 2026 · SecurityWeek, 31 August 2026 · ServiceNow newsroom

Three CVSS 10.0 Flaws, No Authentication Needed. Who In Your Organisation Is Applying That Patch?

Posted on by Dan Wells

On 27 August, ServiceNow published a security advisory covering four vulnerabilities in the AI Platform. Three of them scored a perfect 10.0. None of them need authentication, none need user interaction, and all three are rated low complexity to exploit. If you run ServiceNow self-hosted, the patch is your job, and the clock started two weeks ago.

What was disclosed

  • CVE-2026-18885, CVSS 10.0. Code injection allowing arbitrary code execution, with potential access to and modification of data.
  • CVE-2026-18886, CVSS 10.0. Improper access control allowing an attacker to create or modify arbitrary data and elevate privileges.
  • CVE-2026-74820, CVSS 10.0. SQL injection allowing arbitrary SQL statements against the underlying database, and access to instance data beyond what was intended.
  • CVE-2026-6876, CVSS 8.7. A sandbox escape, also exploitable without authentication.

ServiceNow patched its hosted instances directly. Hotfixes were released for self-hosted deployments across the Xanadu, Yokohama, Zurich and Australia release families. The company says it has no evidence of exploitation and that the issues came out of its own research and responsible disclosure programmes.

The split that matters

ServiceNow states it patched hosted instances. Self-hosted deployments need the hotfix applied by you. Either way, confirm remediation status against your own instance list rather than assuming it, particularly if you have multiple instances or any inherited from an acquisition.

The gap between disclosure and patching

Jason Brown, director of counter fraud operations at iCOUNTER, made the point sharply in SecurityWeek’s coverage. Self-hosted organisations now have to find, schedule and apply the patch themselves, and in many organisations that takes weeks rather than days. During those weeks an unauthenticated attacker with a working exploit has a real shot at systems sitting next to HR records, vendor onboarding and finance approvals. His advice was not to wait for the normal patch cycle and to confirm it is applied this week.

That advice was published on 31 August. It is nine days old.

Why I’m writing about this on a recruitment blog

Because “find, schedule and apply” is not a technical instruction. It is a description of a person, and in a lot of ServiceNow estates that person does not clearly exist.

ServiceNow platform security tends to fall between two teams. The security function owns vulnerability management but often has limited depth on the platform itself. The platform team owns the instance but sits inside IT service management, where security advisories are not the daily rhythm. So the advisory lands, both teams assume the other is handling it, and the patch cycle quietly absorbs something that needed to be treated as urgent.

The organisations that handle this well have one named person who owns ServiceNow platform security specifically. Not security in general. Not the platform in general. The overlap. And that is a genuinely awkward role to fill, because it needs someone who can read a ServiceNow advisory, understand what it touches in your configuration, and have the authority to force an out-of-cycle change.

Four questions worth asking this week

1. Are we hosted or self-hosted, and does everyone in the room agree? It sounds trivial. In organisations with multiple instances and a history of acquisitions, it frequently is not.

2. Who received the 27 August advisory, and what did they do with it? Not who should have received it. Who did.

3. Do we have a route to apply an emergency ServiceNow patch outside the normal change window? If the answer involves a CAB meeting three weeks out, you have found your problem.

4. Is ServiceNow platform security in anyone’s objectives? If it is not written down as someone’s responsibility, it is nobody’s.

The wider pattern

This is the third time this year the same shape has appeared. ServiceNow ships capability at pace, and the operational burden of running it safely lands on customers who have not resourced for it. The AI Platform is now the layer holding your workflow logic, your identity data and your audit trail. Three unauthenticated 10.0s in that layer is a serious thing, and the fact that it was found and fixed responsibly is genuinely reassuring. What is less reassuring is how many organisations will not have applied the hotfix by the end of this month.

If you are self-hosted and you cannot say with confidence that the patch is in, that is today’s job, not this quarter’s.

Need someone who owns the overlap between ServiceNow and security? It is one of the harder profiles in the market and we recruit for it regularly. We can tell you what it pays and how long it takes before you commit to a requisition. Talk to us.

Sources: ServiceNow security advisory, 27 August 2026 · SecurityWeek, 31 August 2026 · BankInfoSecurity, 1 September 2026

Do you need a ServiceNow developer, technical consultant or architect?

Posted on by Dan Wells

Roughly a third of the ServiceNow roles that land on my desk have the wrong title on them.

Not slightly wrong. Wrong in a way that costs the client six weeks and a rejected offer.

The job spec says developer. The interview questions are about integration design and platform governance. The salary band is set at developer level. The candidates who could actually do the work take one look at the money and pass, and the ones who fit the money can’t answer the questions.

Here is how we help clients sort it out before the advert goes live.

The three roles, in plain terms

Developer. Builds what has been specified. Flows, scripts, UI, catalogue items, integrations that someone else has designed. Give a good ServiceNow developer a clear ticket and they will close it. Ask them to sit in front of a CFO and challenge the business case for a Now Assist rollout, and you have put them in the wrong room.

Technical consultant. Sits between the client and the build. Runs the workshops, translates what the business says it wants into what the platform can actually do, then either builds it or hands it to developers. This is the role most people mean when they write “developer” in a job spec. It needs the technical depth of a developer plus the willingness to be in a room with stakeholders who disagree with each other.

Architect. Owns the shape of the platform. Instance strategy, data model, integration patterns, upgrade path, what goes on ServiceNow and what does not. An architect’s value is mostly in the things they stop you doing. If you have one instance, one module and a two-person team, you do not need one yet.

The question that usually settles it

When a client is not sure which one they need, we ask this: who decides how the work gets done?

If the answer is “we tell them what to build”, it is a developer.

If the answer is “we want them to work that out with the business”, it is a technical consultant.

If the answer is “we want them to tell us what we should be building at all”, it is an architect.

That one question resolves most of it in about thirty seconds on a call.

What goes wrong at each level

Hiring a developer when you need a consultant. The most common one. You get someone who builds exactly what the ticket says, and the tickets are wrong because nobody has run a proper workshop with the business. Six months in, the platform works and nobody uses it.

Hiring a consultant when you need a developer. Less damaging, more expensive. You have paid a premium for stakeholder skills you are not using, and the person gets bored. They usually leave inside a year, and their exit interview says “the work wasn’t what I expected”.

Hiring an architect too early. This one comes up when a business has bought a lot of ServiceNow and panicked. A strong architect with no team to direct and no scale to manage will spend three months writing standards documents and then start looking. Architects want complexity. If you cannot give them any, someone else will.

Not hiring an architect when you should have. Usually visible about two years in, when you have four integrations built four different ways, customisation nobody can explain, and an upgrade everyone is afraid of. That is the expensive version.

What this means for your job spec

A few things we ask clients to be specific about before we take a role to market:

Who writes the requirements? If the answer is the person you are hiring, say so in the advert. It changes who applies.

How many people will they work alongside? A consultant in a team of twelve is a different job from a consultant who is the entire ServiceNow function. Both are legitimate. Candidates need to know which one they are walking into.

Which modules, honestly. “ITSM plus a bit of HRSD” is a real answer and it is fine. “Full platform” when you mean ITSM makes experienced people suspicious.

What does the first six months look like? Greenfield implementation, BAU support, and rescuing a bad implementation attract very different people. The third one, done honestly, attracts more people than you would expect. Plenty of good consultants enjoy a mess.

Is the title negotiable? Sometimes the work is architect-level and the internal band is not. Say it early. We would rather find someone who wants the scope more than the title than lose a candidate at offer.

Where partners and customers differ

If you are a ServiceNow partner, your consultants need client-facing polish and the ability to move between three accounts in a week. Your developers need throughput.

If you are an end customer, the same titles mean something different. Your consultant will spend more time on internal politics than on discovery workshops, and your developer will be closer to the business than a partner-side developer ever gets.

Candidates know the difference. When a customer-side spec reads like a partner-side spec, it reads as though you have copied it from somewhere. Which, usually, you have.

Getting it right first time

Most of the mis-hires we get asked to fix were not skills failures. The person could do the job in the spec. The spec just described a job the business did not need.

Twenty minutes scoping the role properly before it goes live saves a lot more than twenty minutes.

If you are about to open a ServiceNow role and you are not certain which of the three it is, send me the spec and I will tell you what I think. No charge and no pitch attached.

ServiceNow’s June 2026 Layoffs: What We’re Hearing

Posted on by Dan Wells
For most ServiceNow professionals, getting a role there was the goal. Not a goal. The goal. I’ve had that conversation hundreds of times with TCs, AEs, and developers across the ecosystem: “If anything comes up at ServiceNow, let me know.”

This past week, I’ve been speaking to a lot of those same people. Most of them are now on the outside.

Here’s what we’re hearing.

The scale

On the morning of 10 June 2026, thousands of ServiceNow employees joined what they thought were routine meetings and found HR on the call. Within minutes, roles were eliminated. By the time the call ended, laptops were locked.

Numbers internally range from 300 to 2,500. California WARN notices filed with the California EDD confirm significant cuts at both the Santa Clara HQ and San Diego office. Multiple directors told us that even VPs were given less than 24 hours’ notice and a script. Nobody below SVP level knew who was on the list or why.

Who got cut, and there’s no clean pattern

This is the part that keeps coming up in every conversation we’re having. Normally in a restructuring, you can find the logic: a product being wound down, a layer of management being removed. Here, nobody can.

The cuts hit sales, solution consulting, marketing, engineering, training, product, CEG, and ServiceNow University. In India, 70% of the DemoHub organisation went in a single Zoom call. In ANZ, entire SSE teams were eliminated. In LATAM, top-performing SC managers got the call.

People with 10 years at the company were let go alongside people who started 90 days ago. Directors were cut on the same calls as junior ICs. One person we spoke to was mid-treatment for a serious illness with strong performance reviews. Another was on maternity leave.

The consistent message from management: “This is not performance related.”

The consistent reality: managers couldn’t explain who was chosen or why. One director summed it up well: “There is no logic, and there is no communication coming from the top.”

The acquisitions

This is almost certainly part of it. ServiceNow acquired Moveworks for around $3 billion (600-plus employees), Armis for a reported figure that brought in over 1,300 people, and Veza on top of that. One well-placed partner contact put it plainly: “They’re offsetting the headcount from the acquisitions. The 2,500 number makes sense when you add it up.”

The Moveworks deal has taken a lot of the heat internally. ServiceNow paid an enormous amount for an AI service management tool that many people we speak to think overlaps heavily with existing platform capability, and that some argue Microsoft will simply replicate through Teams within a couple of years. The view we keep hearing: it was a bad call made at scale.

What people are most frustrated about is that the people paying the price for that decision are not the people who made it.

And for those wondering whether staff who came across from the acquired companies were affected: some appear to have survived, while long-serving ServiceNow employees did not.

What this does to ServiceNow as a place to work

This is the question that matters most to us, because it affects everyone in the ecosystem.

For a long time, working at ServiceNow carried real weight. The culture under founder Fred Luddy was well regarded. People stayed. Loyalty felt like it went both ways. That reputation was a big part of why the company could attract strong talent away from bigger names.

What we’re hearing now is that the culture has been shifting for a while, and this is the moment people are naming as confirmation of something they’d already sensed. There’s frustration about spending on celebrity endorsements and sports hospitality while the people doing the actual work get cut. There’s frustration about an influx of leadership from Salesforce, a company with a notoriously volatile culture, and the sense that some of that has been imported.

One person who ran a team at ServiceNow for nearly a decade said it simply: “I recognised this wasn’t the company I joined eight years ago.”

The employer brand has taken a hit. Whether that’s recoverable depends on what happens next and how quickly.

The general feel

Shocked. Angry at the manner of it, more than the fact of it. But not beaten.

What stings most in the conversations we’re having isn’t the job loss. It’s being locked out of a laptop before the call finished. It’s a manager who had no idea it was coming and had nothing to offer. It’s 14-hour days and years of work, then a Tuesday morning Zoom with HR on the invite.

One person, nearly ten years in and a consistent top performer, said: “People got rich off my dedication. Shame on me for letting them use me like that.”

That’s the tone of a lot of conversations right now.

For what it’s worth: ServiceNow experience carries genuine weight in the market. The calls we’re already having from partners and customers looking to bring people in confirm that. If you’ve been affected, you’re not starting from scratch.

If you’ve been impacted

Get in touch. We know who’s hiring in the ServiceNow space, we’ll give you a straight conversation, and we won’t waste your time.

And if your organisation is looking at a market with a lot of exceptional ServiceNow talent suddenly available, we can help you move quickly on the right people.

Does remote working level out ServiceNow salaries across the UK?

Posted on by Dan Wells

Does remote working level out ServiceNow salaries across the UK?

Partly. The gap is narrowing, but it hasn’t closed, and the way it’s narrowing catches a lot of hiring plans out.

If you’re setting pay bands for ServiceNow roles, the detail matters more than the headline. Here’s what the numbers say, and what they mean for how you hire.

The London premium is still real

On paper, London still pays more. The median ServiceNow Developer salary in London sits around £78,000. Across the UK excluding London, the median is closer to £70,000. That’s a premium of roughly 10 to 15%, which fits the wider pattern: London salaries typically run 10 to 25% ahead of the rest of the country.

So if you benchmark purely on advertised salaries, the regional discount looks alive and well. The problem is that advertised salaries no longer describe how the market actually behaves.

What remote work has changed

Fully remote roles have broken the link between where someone lives and what they can earn. London-headquartered employers now hire ServiceNow talent nationally, and for fully remote positions they’re paying at or near London rates.

A concrete example. A senior ServiceNow developer in Manchester earning £65,000 at a local employer can move to £80,000 or £90,000 working remotely for a London fintech. That’s a 20 to 35% increase in real terms, before you factor in that their cost of living hasn’t moved an inch.

That candidate exists, and your local pay band is competing with the offer they just received.

Who actually benefits

Here’s the part most employers get wrong. Remote work is levelling salaries, but the benefit lands almost entirely with the regional candidate, not the employer.

Going remote doesn’t buy you cheaper ServiceNow talent. The same national market that lets you hire from anywhere lets every London employer bid for the same people. What going remote buys you is a bigger pool, and that’s worth a lot, but it’s a different thing from a saving.

Flexibility is the new London weighting

The reverse is also now priced in. Mandating three or more days in the office shrinks your pool to people within commuting distance, and those people are fielding remote offers at equal or better money. In practice, flexibility has replaced the old London weighting as part of the package. If you take the flexibility away, you pay a premium to compensate.

This is the trade most office-attendance policies never cost out. The policy gets set on culture grounds, the pay bands stay where they were, and six months later the business is asking why every senior shortlist needs a salary exception.

The caveat: location still shows up in some pay bands

It’s not total levelling, and it’s worth being precise about this. A number of employers have introduced location-based pay adjustments, cutting salaries by 10 to 20% for staff who relocate away from London. Some firms still build location into their bands and defend it.

So the honest position is this: the direction of travel is towards levelling, but the market is mixed, and you’ll find both models in play when you benchmark.

What this means for your pay bands

Three practical conclusions fall out of the data.

First, benchmark against the market your candidates are actually in, not the city your office is in. A regional candidate for a remote role is comparing you with London money, whatever your postcode says.

Second, decide what your office policy is worth and price it. If you need people in three days a week, that’s a constraint candidates will charge you for. Budget for it rather than discovering it offer by offer.

Third, treat the regional discount as a closing assumption, not a standing one. It still exists in parts of the market, but every quarter it explains less of what candidates accept.

One note on the data

The ServiceNow salary medians above come from job-advert samples that get fairly small once you split by region. Treat them as directional rather than precise. The direction, though, is consistent across every source: the gap is narrowing, the candidate is the one capturing the difference, and flexibility is now part of the price.

If you’re setting ServiceNow pay bands and want a second opinion on the numbers, book a meeting with me below

Opening a satellite office for tech talent? Pick the city for the right reason

Posted on by Dan Wells

Opening a satellite office for tech talent? Pick the city for the right reason

Somewhere in your leadership team, someone has floated a satellite office. The case usually writes itself: cheaper salaries outside London, access to a regional talent pool, a flag on the map. Two of those three reasons hold up. The one driving most decisions doesn’t.

Here’s how to think it through, with the UK’s main contenders weighed against each other.

The salary saving has mostly gone

The original logic for a regional office was arbitrage. London salaries run 10 to 25% ahead of the rest of the UK, so an office in Manchester or Leeds meant the same skills at a discount.

Remote hiring has competed most of that away. London employers now recruit nationally for remote roles and pay at or near London rates to win the candidate. A senior ServiceNow developer in Manchester fielding remote offers at £80,000 to £90,000 isn’t going to join your new regional office at the old local rate of £65,000. The market they sit in has already repriced them.

There’s still some relief on the contract side, where regional day rates run 20 to 30% below London equivalents. But for permanent senior hires, budget for near-London money wherever the desk is. If your business case for the office rests on payroll savings, rebuild the case.

What an office actually buys you

A physical anchor in a talent cluster. That’s the real product, and it’s worth paying for if you buy it deliberately.

It means local brand presence, so candidates in that city think of you before they think of a faceless remote employer. It means proximity to a community of practice: meetups, user groups, the informal network through which senior people hear about roles. And it gives a distributed team somewhere to gather, which matters more for retention than most businesses expect.

None of that shows up in a payroll line. All of it shows up in time-to-hire and attrition.

Manchester: the default answer

If the logic is “go where the most people are,” the answer is Manchester. It’s the most active UK technology market outside London, accounting for roughly 8% of national developer vacancy volume. It has more than 10,000 digital and tech businesses and the largest fintech scene outside the capital, which matters for enterprise platform work because demand tends to track ITSM, financial services and large enterprise.

Depth is the thing Manchester offers that the other contenders can’t match. Whatever the specialism, there are more of them there.

The runners-up, by use case

Edinburgh, if the work skews towards data, AI or fintech. It has built a distinct identity around data science and deep tech, with a steady supply of technically strong graduates coming out of its universities.

Birmingham, if connectivity and cost matter more than senior depth. Over 40,000 people work in digital roles there, with strength in fintech, cyber security and software, and the transport links to London and Manchester are the best of any contender. The trade-off is real though: for senior specialist roles, the local pool is still developing compared with the bigger hubs. If your hiring plan leans senior, that constraint will bite first.

Leeds, if health tech or data is the niche. It’s building a name in both, and it’s the value option of the four.

The question that decides it

Before comparing cities, answer this: is the office there to recruit from the local pool, or to give an already-remote team somewhere to gather?

If it’s recruitment-led, follow the density. That points to Manchester, because the whole point is the number of qualified people within reach of the office.

If it’s a hub for a distributed team, the local talent pool barely matters. Transport links and cost per desk move to the top of the list, and Birmingham’s case gets much stronger.

Most location decisions go wrong because nobody answered that question first. The city gets chosen on cost per desk, and then the business wonders why the local hiring it half-expected never materialised.

The short version

The salary arbitrage is mostly gone, so stop pricing the office as a saving. Price it as a recruitment asset. Recruitment-led: Manchester on density, Edinburgh for data and AI depth. Team hub: Birmingham on connectivity and cost. And decide which of those two offices you’re actually opening before anyone books a viewing.

If you’re weighing up a location decision and want to talk through what the talent market looks like in each city, book a meeting with me below.

ServiceNow Eyes $7 Billion Acquisition of Cybersecurity Startup Armis

Posted on by Dan Wells

ServiceNow is reportedly in advanced discussions to acquire Armis, a San Francisco-based cybersecurity startup, in a deal valued at approximately $7 billion. This acquisition would mark one of ServiceNow’s most significant strategic moves as the workflow automation giant continues to expand its security capabilities and strengthen its position in the enterprise technology market.

About Armis

Founded in 2015 by Yevgeny Dibrov and Nadir Izrael, both Israel Institute of Technology graduates with backgrounds in the Israel Defence Forces software units, Armis has become a leader in cybersecurity asset management. The company’s flagship Centrix platform provides real-time visibility, risk assessment, and protection across an organisation’s entire digital attack surface.

Armis has demonstrated impressive growth, reaching $300 million in annual recurring revenue earlier this year, up from $200 million the previous year. The company was last valued at $6.1 billion following a $435 million funding round in November 2024. Its client roster includes major organisations such as Colgate-Palmolive, United Airlines, and NHS South Wales.

Strategic Implications

This acquisition aligns with ServiceNow’s aggressive expansion strategy in the security space. Earlier this month, ServiceNow acquired identity security startup Veza for an undisclosed sum, and in March, the company purchased AI firm Moveworks. The potential Armis deal represents ServiceNow’s commitment to building a comprehensive security portfolio that complements its workflow automation platform.

For ServiceNow professionals and organisations invested in the ecosystem, this acquisition signals continued innovation and expansion of security capabilities within the platform. As the deal nears completion, industry watchers expect the integration of Armis’s technology to enhance ServiceNow’s security offerings and create new opportunities for implementation and specialisation.

The deal is expected to be announced within days, pending final negotiations.

Let's get started

Talk to one of our consultants todays, if you're looking to register a vacancy and apply for a role.

Upload your CV

Submit CV

This field is for validation purposes and should be left unchanged.
Name(Required)
Consent(Required)
Max. file size: 2 GB.