Product Security Engineer

Hitachi Vantara; Pune District; On-site; INR 1,800,000 - 3,200,000; Full time

Job summary

Hitachi Vantara seeks a Product Security Engineer to strengthen product security across the SDLC and lead vulnerability management, security assessments, remediation, and Secure SDLC/DevSecOps initiatives in collaboration with Engineering, Product, Cloud Operations, Support, and Security teams.

The role emphasizes a hands-on approach to identifying security risks, conducting code reviews, and guiding engineering teams on secure remediation and shift-left security across cloud-native deployments.

Qualifications

• 8+ years of experience in Application Security, Product Security, or related fields.
• Strong knowledge of OWASP Top 10, CWE, CVSS, secure coding, and risk analysis.
• Experience with security assessments, vulnerability triage, remediation, and governance.

Responsibilities

• Act as primary security contact for Engineering, Product, and Support teams; understand product architecture and APIs.
• Lead vulnerability triage, remediation, and reporting across SAST/DAST/CI tools and customer issues.
• Promote Secure SDLC and DevSecOps practices across Java, Python, Node.js, .NET and cloud-native apps.

Skills

Application Security

DevSecOps

Vulnerability Mgmt

Secure Coding

Kubernetes

Cloud Security

Incident Response

Cross-functional

Tools

Black Duck

Black Duck SRM

AppScan

Qualys

SonarQube

Burp Suite

Dependency Scanning

Job description

Product Security Engineer

The Product Security Engineer strengthens Hitachi Vantara's product security across the Software Development Lifecycle (SDLC), driving vulnerability management, security assessments, remediation, Secure SDLC, and DevSecOps initiatives in collaboration with Engineering, Product, Cloud Operations, Support, and Security teams.

Key Responsibilities

• Product Security Expertise
  • Develop understanding of product architecture, technology stacks, APIs, integrations, and deployment models; act as the primary security contact for Engineering, Product, and Support teams.
  • Identify product security risks and support security assessments and customer escalations.
  • Familiarity with NFS, SMB, LDAP, Active Directory, Kerberos, TLS/SSH, PKI, REST API security, access controls, Amazon S3, tenant isolation, Kubernetes RBAC, secrets management, and encryption.
• Security Triage & Vulnerability Management
  • Perform vulnerability triage, reproduction, validation, and risk assessment using CVSS, exploitability, and business/customer impact.
  • Lead vulnerability identification, prioritization, remediation, and reporting across SAST, DAST, SCA, penetration tests, bug bounty programs, and customer-reported issues.
  • Establish remediation SLAs, track findings to closure, validate fixes, and drive root cause analysis and corrective actions.
• Secure Software Development & DevSecOps
  • Promote Secure SDLC and secure coding practices across Java, Python, Node.js, .NET, and cloud-native applications.
  • Develop security standards, conduct code reviews, validate fixes, and guide engineering teams on sustainable remediation.
  • Integrate security controls and scanning tools into CI/CD pipelines, automate security validation, and promote shift-left practices.
  • Support security implementation across Kubernetes, Docker, containers, IaC, and cloud-native deployment pipelines.
• Incident Response & Governance
  • Investigate and remediate product security incidents, conduct root cause analysis, and recommend preventive controls.
  • Collaborate with Engineering, Cloud Operations, Support, and Security teams during incident response.
  • Support SOC 2, ISO 27001, NIST, CIS, customer security assessments, audits, evidence collection, and remediation tracking.
  • Maintain security documentation and ensure alignment with corporate security policies and risk governance frameworks.
• Security Leadership & Enablement
  • Act as Product Security SME, mentor teams on security best practices, and deliver security awareness and secure coding training.
  • Stay updated on emerging vulnerabilities, threats, attack techniques, and mitigation strategies.

Required Skills & Experience

• 8+ years of experience in Application Security, Product Security, Cybersecurity, DevSecOps, or Software Engineering.
• Strong knowledge of OWASP Top 10, CWE, CVSS, secure coding, vulnerability assessment, security triage, remediation, and risk analysis.
• Understanding of enterprise architectures, APIs, microservices, distributed systems, SaaS, OAuth, OIDC, SAML, and IAM.
• Hands-on experience with Black Duck, Black Duck SRM, AppScan, Qualys, SonarQube, Burp Suite, and dependency scanning tools.
• Familiarity with Kubernetes, Docker, CI/CD security, DevSecOps, AWS/Azure, container security, and cloud-native environments.
• Proven vulnerability remediation experience with strong analytical, troubleshooting, and cross-functional collaboration skills.

Preferred Certifications

CISSP, CSSLP, Security+, GIAC, CCSP, AWS Security, or Azure Security.

Success Metrics

• Reduced critical/high vulnerabilities and security incidents.
• Improved remediation SLAs and vulnerability resolution.
• Increased DevSecOps adoption and security automation.
• Improved product security, compliance, and audit readiness.
• Enhanced security awareness across Engineering and Support teams.

Works Closely With

Engineering Managers, Product Owners, Architects, DevOps Leads, Customer Support, Security Operations, and Customer Escalation Teams.