Sr. Product Security Response Engineer

Hewlett Packard Enterprise; Bengaluru; Hybrid; INR 2,800,000 - 5,200,000; Full time

Benefits offered by this job

Health & Wellbeing

Professional Development

Inclusive culture

Job summary

Hewlett Packard Enterprise is seeking a Sr. Product Security Response Engineer in Bengaluru for a hybrid role requiring two days per week in-office. You will lead vulnerability investigations, coordinate with product teams, and contribute to security advisories and remediation guidance.

The ideal candidate has 8–10 years of relevant experience in product security, strong Python skills, and familiarity with CVE/CWE/CVSS frameworks. Join a global cybersecurity team driving secure product delivery.

Qualifications

• Bachelor’s or Master’s degree in computer science, cybersecurity, information systems, engineering, or related field.
• Hands-on experience independently managing complex vulnerability investigations across multiple products, platforms, or technical environments.
• Experience with Python or another scripting language used to support security analysis, testing, or workflow automation.

Responsibilities

• Own vulnerability cases from intake to remediation and disclosure readiness, triage credibility and scope.
• Conduct hands-on analysis to reproduce vulnerabilities and validate exploitability.
• Lead investigations, coordinate with product teams, and prepare technical findings and remediation guidance.
• Improve PSRT processes and tooling to increase efficiency and consistency.

Skills

Python

Education

Bachelor’s or Master’s degree in computer science, cybersecurity, information systems, engineering, or related field

Tools

Python

Job description

Sr. Product Security Response Engineer

This role has been designed as 'Hybrid' with a requirement that you will work on average 2 days per week from an HPE office.

Who We Are

Hewlett Packard Enterprise is the global edge-to-cloud company advancing the way people live and work. We help companies connect, protect, analyze, and act on their data and applications wherever they live, from edge to cloud, so they can turn insights into outcomes at the speed required to thrive in today’s complex world. Our culture thrives on finding new and better ways to accelerate what’s next. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good. If you are looking to stretch and grow your career our culture will embrace you. Open up opportunities with HPE.

Job Description

About our cybersecurity team Are you ready to make an impact at one of the world’s leading tech companies? HPE’s Cybersecurity team is where you can do just that! We’re looking for a dynamic and experienced GRC specialist to join our Cybersecurity team. If you’re passionate about shaping the future of cybersecurity and ready for your next challenge, we’d love to hear from you.

As a Cybersecurity GRC Platform Architect, you will design, configure, integrate, and enhance the technology capabilities supporting cybersecurity governance, risk, compliance, and third‑party risk management. You will translate complex requirements into scalable workflows, reliable data, actionable reporting, and practical automation. You will independently deliver complex platform solutions, recommend technical approaches, and partner with cybersecurity, risk, compliance, policy, and IT teams. You will also establish reusable technical patterns and provide guidance to platform users and less-experienced contributors.

Responsibilities

• Product Security Response Owning and driving complex product vulnerability cases from initial intake through technical resolution and disclosure readiness, maintaining clear status, evidence, decisions, ownership, and next actions. Triaging vulnerability reports for credibility, scope, affected products or versions, exploitability, potential customer impact, duplication, and completeness of supporting evidence. Reproducing reported vulnerabilities and validating proofs of concept in collaboration with product engineering, penetration testing, security research, and other technical specialists. Coordinating technical investigations with product teams, resolving information gaps, aligning on responsibilities, and keeping cases moving toward remediation and disclosure milestones. Assessing vulnerability severity using applicable scoring methods and available technical evidence while documenting assumptions, rationale, and unresolved questions. Supporting the development, review, and technical quality of customer‑facing security advisories, vulnerability disclosures, remediation guidance, and related content. Engaging internal stakeholders and external vulnerability reporters or coordination partners to clarify findings, gather evidence, communicate status, and support coordinated disclosure. Applying knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices to support accurate classification and reporting. Monitoring case queues and emerging demand, identifying cases at risk of delay, and helping maintain consistent execution across PSRT operating areas. Contributing across diverse product environments and adapting to differences in architecture, development practices, and organizational ownership.
• Vulnerability Investigation and Security Validation Performing hands‑on technical analysis to reproduce vulnerabilities, validate exploitability, determine affected configurations or versions, and assess potential impact. Reviewing proof‑of‑concept code, logs, source code, configurations, system behavior, product architecture, and other evidence relevant to vulnerability investigations. Developing or adapting scripts, test harnesses, proofs of concept, and technical methods needed to validate findings and support remediation decisions. Conducting targeted security testing when vulnerability reports require deeper technical analysis or independent validation beyond the information submitted. Partnering directly with product engineering teams to understand product design, validate findings, support remediation, and perform retesting as appropriate. Producing clear technical findings that describe evidence, affected components, reproduction steps, security impact, and actionable remediation guidance. Defining investigation and testing approaches based on product architecture, threat models, reported vulnerabilities, known attack techniques, and areas of highest security risk. Distinguishing confirmed vulnerabilities from false positives, unsupported claims, configuration issues, or findings that require additional evidence. Escalating investigations to appropriate specialists when cases require expertise beyond the role’s technical domain.
• PSRT Process and Capability Improvement Identifying recurring vulnerability patterns, operational friction, process gaps, and opportunities to improve PSRT guidance, playbooks, templates, and technical practices. Contributing reusable scripts, tooling, integrations, and automation that reduce repetitive work and improve the consistency or quality of vulnerability response. Helping improve case documentation, evidence requirements, review practices, and quality checks across the response lifecycle. Supporting improvements to vulnerability intake, triage, reproduction, severity assessment, remediation coordination, advisory preparation, and case closure. Capturing reusable techniques and lessons learned so future investigations can be completed more efficiently and consistently. Using approved automation or AI‑assisted capabilities where they provide practical value while validating outputs and preserving accountable human judgment. Measuring the effectiveness of process or tooling improvements and adjusting approaches based on operational results and team feedback.
• Technical Collaboration and Leadership Leading significant vulnerability investigations or focused technical workstreams while remaining directly involved in hands‑on execution. Providing technical guidance to engineers, case managers, and product teams on vulnerability analysis, evidence quality, severity assessment, remediation, and disclosure readiness. Reviewing technical findings, investigation approaches, and security communications for accuracy, completeness, and actionable guidance. Communicating complex findings, risks, tradeoffs, and recommendations clearly to engineering teams, security specialists, product leaders, and other stakeholders. Building productive working relationships across product engineering, PSRT, penetration testing, security research, and adjacent security teams. Mentoring less‑experienced team members and sharing practical knowledge that strengthens the broader team’s vulnerability‑response capability. Representing PSRT in cross‑functional discussions and helping stakeholders reach evidence‑based technical decisions.

What you need to bring

Education and Experience Requirements

Bachelor’s or Master’s degree in computer science, cybersecurity, information systems, engineering, or a related field, or equivalent practical experience. Typically 8 to 10 years of relevant experience in product security response, application security, vulnerability management, penetration testing, incident response, security engineering, or closely related technical work.

Demonstrated experience independently managing complex vulnerability investigations across multiple products, platforms, or technical environments. Strong ability to analyze vulnerability reports, proof‑of‑concept code, logs, source code, configurations, system architectures, and other technical evidence. Hands‑on experience reproducing vulnerabilities, validating exploitability, assessing impact, and supporting remediation or retesting. Working knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices. Experience authoring or reviewing security advisories, vulnerability disclosures, technical findings, or remediation guidance. Experience with Python or another scripting or programming language used to support security analysis, testing, or workflow automation. Familiarity with APIs, source control, CI/CD pipelines, containers, cloud environments, or modern software delivery practices. Strong knowledge of common software weaknesses, secure coding practices, threat modeling, and secure development lifecycle principles. Ability to lead significant technical work, exercise independent judgment, coordinate across teams, and influence decisions without relying on formal authority. Strong analytical, technical writing, and communication skills across engineering, security, product, and leadership audiences.

Preferred Qualifications

• Experience working in a PSIRT or PSRT supporting enterprise technology products or services.
• Experience engaging vulnerability reporters, product engineering teams, disclosure partners, or vulnerability‑coordination communities.
• Demonstrated experience planning and performing targeted penetration tests or security assessments in support of vulnerability investigations.
• Experience investigating vulnerabilities affecting applications, services, APIs, cloud environments, firmware, operating systems, networking products, or supporting infrastructure.
• Experience developing scripts, test harnesses, proofs of concept, integrations, or workflow automation for security operations.
• Familiarity with vulnerability management platforms, case‑management systems, security‑advisory publishing processes, or machine‑readable advisory formats.
• Experience supporting high‑impact or broadly disclosed vulnerabilities involving complex product ownership or cross‑organizational coordination.
• Relevant security, cloud, application security, or software engineering certifications are valued but not required.

Complex vulnerability cases are technically sound, well documented, and moved forward with clear ownership, timely stakeholder engagement, and evidence‑based decisions. Product teams receive actionable findings, credible severity and impact assessments, and practical support through remediation and retesting. Security advisories and vulnerability disclosures are accurate, consistent, complete, and ready for customer communication. Investigations distinguish genuine product risk from false positives, incomplete reports, unsupported claims, and configuration‑specific issues. PSRT casework becomes more consistent and efficient through improved playbooks, templates, technical methods, tooling, and knowledge sharing. Automation reduces repetitive work and improves response quality without weakening technical validation, traceability, or accountability. Cross‑functional investigations remain coordinated, risks and delays are identified early, and cases continue progressing toward resolution. Less‑experienced team members grow through practical mentoring, technical review, and shared investigation experience.

Accessibility

HPE is committed to creating an inclusive and accessible workplace and encourages applications from all qualified individuals, including those with disabilities. If you believe you require accommodation during any stage of the application or interview process, please submit your request by completing our secure form linked.

Note: This option is reserved for applicants needing assistance/reasonable accommodation related to a disability.

What We Can Offer You

Health & Wellbeing

We strive to provide our team members and their loved ones with a comprehensive suite of benefits that supports their physical, financial and emotional wellbeing.

Personal & Professional Development

We also invest in your career because the better you are, the better we all are. We have specific programs catered to helping you reach any career goals you have — whether you want to become a knowledge expert in your field or apply your skills to another division.

Unconditional Inclusion

We are unconditionally inclusive in the way we work and celebrate individual uniqueness. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good.

Let's Stay Connected

Follow @HPECareers on Instagram to see the latest on people, culture and tech at HPE.

Job

Engineering

Job Level

TCP_04

Equal Employment Opportunity

HPE is an Equal Employment Opportunity/ Veterans/Disabled/LGBT employer. We do not discriminate on the basis of race, gender, or any other protected category, and all decisions we make are made on the basis of qualifications, merit, and business need. Our goal is to be one global team that is representative of our customers, in an inclusive environment where we can continue to innovate and grow together.

E-Verify

HPE will comply with all applicable laws related to employer use of arrest and conviction records, including laws requiring employers to consider for employment qualified applicants with criminal histories. We are an E‑Verify employer. E‑Verify is an Internet‑based system that compares information from an employee's Form I‑9, Employment Eligibility Verification, to data from U.S. Department of Homeland Security and Social Security Administration records to confirm the employment eligibility of all newly hired employees.