Sr. Product Security Response Engineer

Are you ready to make an impact at one of the world’s leading tech companies? HPE’s Cybersecurity team is where you can do just that! We’re looking for a dynamic and experienced GRC specialist to join our Cybersecurity team. If you’re passionate about shaping the future of cybersecurity and ready for your next challenge, we’d love to hear from you.

As a Cybersecurity GRC Platform Architect, you will design, configure, integrate, and enhance the technology capabilities supporting cybersecurity governance, risk, compliance, and third-party risk management. You will translate complex requirements into scalable workflows, reliable data, actionable reporting, and practical automation.

You will independently deliver complex platform solutions, recommend technical approaches, and partner with cybersecurity, risk, compliance, policy, and IT teams. You will also establish reusable technical patterns and provide guidance to platform users and less-experienced contributors.

What You’ll Do

Responsibilities:

• Owning and driving complex product vulnerability cases from initial intake through technical resolution and disclosure readiness, maintaining clear status, evidence, decisions, ownership, and next actions.
• Triaging vulnerability reports for credibility, scope, affected products or versions, exploitability, potential customer impact, duplication, and completeness of supporting evidence.
• Reproducing reported vulnerabilities and validating proofs of concept in collaboration with product engineering, penetration testing, security research, and other technical specialists.
• Coordinating technical investigations with product teams, resolving information gaps, aligning on responsibilities, and keeping cases moving toward remediation and disclosure milestones.
• Assessing vulnerability severity using applicable scoring methods and available technical evidence while documenting assumptions, rationale, and unresolved questions.
• Supporting the development, review, and technical quality of customer-facing security advisories, vulnerability disclosures, remediation guidance, and related content.
• Engaging internal stakeholders and external vulnerability reporters or coordination partners to clarify findings, gather evidence, communicate status, and support coordinated disclosure.
• Applying knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices to support accurate classification and reporting.
• Monitoring case queues and emerging demand, identifying cases at risk of delay, and helping maintain consistent execution across PSRT operating areas.
• Contributing across diverse product environments and adapting to differences in architecture, development practices, and organizational ownership.

• Performing hands-on technical analysis to reproduce vulnerabilities, validate exploitability, determine affected configurations or versions, and assess potential impact.
• Reviewing proof-of-concept code, logs, source code, configurations, system behavior, product architecture, and other evidence relevant to vulnerability investigations.
• Developing or adapting scripts, test harnesses, proofs of concept, and technical methods needed to validate findings and support remediation decisions.
• Conducting targeted security testing when vulnerability reports require deeper technical analysis or independent validation beyond the information submitted.
• Partnering directly with product engineering teams to understand product design, validate findings, support remediation, and perform retesting as appropriate.
• Producing clear technical findings that describe evidence, affected components, reproduction steps, security impact, and actionable remediation guidance.
• Defining investigation and testing approaches based on product architecture, threat models, reported vulnerabilities, known attack techniques, and areas of highest security risk.
• Distinguishing confirmed vulnerabilities from false positives, unsupported claims, configuration issues, or findings that require additional evidence.
• Escalating investigations to appropriate specialists when cases require expertise beyond the role’s technical domain.

• Identifying recurring vulnerability patterns, operational friction, process gaps, and opportunities to improve PSRT guidance, playbooks, templates, and technical practices.
• Contributing reusable scripts, tooling, integrations, and automation that reduce repetitive work and improve the consistency or quality of vulnerability response.
• Helping improve case documentation, evidence requirements, review practices, and quality checks across the response lifecycle.
• Supporting improvements to vulnerability intake, triage, reproduction, severity assessment, remediation coordination, advisory preparation, and case closure.
• Capturing reusable techniques and lessons learned so future investigations can be completed more efficiently and consistently.
• Using approved automation or AI-assisted capabilities where they provide practical value while validating outputs and preserving accountable human judgment.
• Measuring the effectiveness of process or tooling improvements and adjusting approaches based on operational results and team feedback.

• Leading significant vulnerability investigations or focused technical workstreams while remaining directly involved in hands-on execution.
• Providing technical guidance to engineers, case managers, and product teams on vulnerability analysis, evidence quality, severity assessment, remediation, and disclosure readiness.
• Reviewing technical findings, investigation approaches, and security communications for accuracy, completeness, and actionable guidance.
• Communicating complex findings, risks, tradeoffs, and recommendations clearly to engineering teams, security specialists, product leaders, and other stakeholders.
• Building productive working relationships across product engineering, PSRT, penetration testing, security research, and adjacent security teams.
• Mentoring less-experienced team members and sharing practical knowledge that strengthens the broader team’s vulnerability-response capability.
• Representing PSRT in cross-functional discussions and helping stakeholders reach evidence-based technical decisions.

• Bachelor’s or Master’s degree in computer science, cybersecurity, information systems, engineering, or a related field, or equivalent practical experience.
• Typically 6 to 10 years of relevant experience in product security response, application security, vulnerability management, penetration testing, incident response, security engineering, or closely related technical work.
• Demonstrated experience independently managing complex vulnerability investigations across multiple products, platforms, or technical environments.
• Strong ability to analyze vulnerability reports, proof-of-concept code, logs, source code, configurations, system architectures, and other technical evidence.
• Hands-on experience reproducing vulnerabilities, validating exploitability, assessing impact, and supporting remediation or retesting.
• Working knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices.
• Experience authoring or reviewing security advisories, vulnerability disclosures, technical findings, or remediation guidance.
• Experience with Python or another scripting or programming language used to support security analysis, testing, or workflow automation.
• Familiarity with APIs, source control, CI/CD pipelines, containers, cloud environments, or modern software delivery practices.
• Strong knowledge of common software weaknesses, secure coding practices, threat modeling, and secure development lifecycle principles.
• Ability to lead significant technical work, exercise independent judgment, coordinate across teams, and influence decisions without relying on formal authority.
• Strong analytical, technical writing, and communication skills across engineering, security, product, and leadership audiences.

• Experience working in a PSIRT or PSRT supporting enterprise technology products or services.
• Experience engaging vulnerability reporters, product engineering teams, disclosure partners, or vulnerability-coordination communities.
• Demonstrated experience planning and performing targeted penetration tests or security assessments in support of vulnerability investigations.
• Experience investigating vulnerabilities affecting applications, services, APIs, cloud environments, firmware, operating systems, networking products, or supporting infrastructure.
• Experience developing scripts, test harnesses, proofs of concept, integrations, or workflow automation for security operations.
• Familiarity with vulnerability management platforms, case-management systems, security-advisory publishing processes, or machine-readable advisory formats.
• Experience supporting high-impact or broadly disclosed vulnerabilities involving complex product ownership or cross-organizational coordination.
• Relevant security, cloud, application security, or software engineering certifications are valued but not required.

• Complex vulnerability cases are technically sound, well documented, and moved forward with clear ownership, timely stakeholder engagement, and evidence-based decisions.
• Product teams receive actionable findings, credible severity and impact assessments, and practical support through remediation and retesting.
• Security advisories and vulnerability disclosures are accurate, consistent, complete, and ready for customer communication.
• Investigations distinguish genuine product risk from false positives, incomplete reports, unsupported claims, and configuration-specific issues.
• PSRT casework becomes more consistent and efficient through improved playbooks, templates, technical methods, tooling, and knowledge sharing.
• Automation reduces repetitive work and improves response quality without weakening technical validation, traceability, or accountability.
• Cross-functional investigations remain coordinated, risks and delays are identified early, and cases continue progressing toward resolution.
• Less-experienced team members grow through practical mentoring, technical review, and shared investigation experience.

HPE is committed to creating an inclusive and accessible workplace and encourages applications from all qualified individuals, including those with disabilities. If you believe you require accommodation during any stage of the application or interview process, please submit your request by completing our secure form linked here.

Note: This option is reserved for applicants needing assistance/reasonable accommodation related to a disability.

We strive to provide our team members and their loved ones with a comprehensive suite of benefits that supports their physical, financial and emotional wellbeing.

We also invest in your career because the better you are, the better we all are. We have specific programs catered to helping you reach any career goals you have — whether you want to become a knowledge expert in your field or apply your skills to another division.

We are unconditionally inclusive in the way we work and celebrate individual uniqueness. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good.

HPE will comply with all applicable laws related to employer use of arrest and conviction records, including laws requiring employers to consider for employment qualified applicants with criminal histories.

We have become aware of an increase in fraudulent recruitment activities in which individuals impersonate our company or authorized recruitment agencies to offer fake employment opportunities. These scams may occur through false websites, emails, social media, or chat-based applications and often aim to obtain personal information or money. Please note that Hewlett Packard Enterprise (HPE), its direct and indirect subsidiaries and affiliated companies, and its authorized recruitment agencies/vendors will never charge a candidate a registration fee, hiring fee, or any other fee in connection with its recruitment and hiring process. We also never request personal information such as back account details, Social Security numbers, or national IDs via social media or chat applications.

All legitimate job opportunities will come through official company channels, and candidates are responsible for verifying the credentials of any third party claiming to represent the company. Any reliance on fraudulent communication is at the individual’s own risk, and HPE disclaims legal liability for any resulting damages. If you suspect recruitment fraud, do not share personal information or make any payments and report the incident to your local authorities immediately.