Security Platform Engineer - Poly

The Security Platform Engineer owns the reusable platform capabilities that embed security and compliance into our development and delivery workflows. You will build and run the security tooling, test environments, and processes that keep our Android- and Linux-based devices secure, from code scanning in CI to penetration testing on real hardware.

You will own our vulnerability management process end to end: generating SBOMs, triaging reported vulnerabilities, assessing their impact on our products, and driving fixes through to release. You will report to the Platform Engineering manager and work closely with the Infrastructure & Automation Technical Lead, product development teams, and HP security.

Platform Engineering builds and runs the developer platform behind Poly Video products, built on PolyOS, our Android-based OS. We own the path from commit to validated release: source control, CI/CD, build compute and storage, artifact management, and automated testing.

Key tools and technologies you'll work with:

• GitHub Enterprise and GitHub Actions
• Python
• Android and Linux builds
• SBOM and vulnerability scanning tools
• Static analysis and code scanning (SonarQube)
• Penetration testing and network analysis tools
• Docker, Proxmox, and VM infrastructure

• Own intake, triage, and tracking of reported vulnerabilities, from CVE feeds, scanners, customers, and researchers
• Assess exploitability and impact on our products, and recommend next steps: patch, mitigate, or document as not affected
• Drive fixes with development teams and track them through to release
• Produce vulnerability status reports and advisories for engineering and leadership

• Generate and maintain SBOMs for every product release, covering Android, Linux, and third-party components
• Automate SBOM generation and vulnerability matching in the build pipeline
• Support open-source license compliance and third-party component reviews

• Build reusable GitHub Actions workflows for static analysis, dependency scanning, and secrets detection
• Define and enforce security gates on pull requests and release builds
• Tune scanners to reduce noise so developers act on real findings

• Design and maintain isolated penetration testing environments for our devices
• Perform hands-on penetration testing of devices, network services, web interfaces, and APIs
• Automate recurring security tests and integrate them with our hardware test lab
• Report findings clearly, with severity, reproduction steps, and remediation guidance

• Support EU Cyber Resilience Act readiness, including SBOM and vulnerability-handling obligations
• Support FIPS and Common Criteria certification efforts with evidence, testing, and documentation
• Partner with HP security teams on policy, audits, and coordinated disclosure

• Bachelor's degree in Computer Science, Cybersecurity, or a related field
• 4+ years in product security, application security, DevSecOps, or security engineering
• Hands-on vulnerability management: CVE triage, CVSS scoring, exploitability assessment, and remediation tracking
• Experience generating and analyzing SBOMs (SPDX or CycloneDX) and using software composition analysis tools
• Hands-on penetration testing of network services, web interfaces, or APIs, with tools such as Burp Suite, Nmap, or Metasploit
• Python scripting for security automation
• Experience integrating security scanning into CI/CD pipelines (GitHub Actions or similar)
• Clear written communication, including findings reports for both engineers and leadership

• Android platform security: SELinux policy, verified boot, app sandboxing, and Android security bulletins
• Embedded or IoT device security testing, including hardware interfaces (UART, JTAG) and firmware analysis
• Experience with EU Cyber Resilience Act, FIPS 140-3, or Common Criteria
• Strong Linux skills, including networking, services, and system hardening
• SBOM and vulnerability tools such as Syft, Grype, Trivy, Dependency-Track, or Black Duck
• Static analysis and code scanning tools such as SonarQube, CodeQL, or Semgrep
• Fuzzing tools and techniques (AFL++, libFuzzer, or protocol fuzzers)
• Experience with VEX statements and coordinated vulnerability disclosure
• Security certifications such as OSCP, GPEN, GWAPT, or CISSP

Salary Range: $111,400-$161,550

HP, Inc. provides equal employment opportunity to all employees and prospective employees, without regard to race, color, religion, sex, national origin, ancestry, citizenship, sexual orientation, age, disability, or status as a protected veteran, marital status, familial status, physical or mental disability, medical condition, pregnancy, genetic predisposition or carrier status, uniformed service status, political affiliation or any other characteristic protected by applicable national, federal, state, and local law(s).

Please be assured that you will not be subject to any adverse treatment if you choose to disclose the information requested. This information is provided voluntarily. The information obtained will be kept in strict confidence.