Security Platform Engineer - Poly

Hp Iq; Austin (TX); On-site; USD 111,000 - 162,000; Full time

Benefits offered by this job

Health insurance

Vision insurance

Long term/short term disability

Employee assistance program

Flexible spending account

Life insurance

Parental leave

Paid holidays

Flexible vacation and sick leave

Job summary

HP is seeking a Security Platform Engineer to own the reusable platform capabilities that embed security into our development and delivery workflows. You will build and run the security tooling, test environments, and processes that keep our Android- and Linux-based devices secure, from code scanning in CI to penetration testing on real hardware.

You will own our vulnerability management process end to end: generating SBOMs, triaging reported vulnerabilities, assessing their impact on our

Qualifications

• Bachelor's degree in CS, cybersecurity, or a related field.
• 4+ years in product security, DevSecOps, or security engineering.
• Hands-on vulnerability management: CVE triage, CVSS scoring, exploitability assessment, and remediation tracking.
• Experience generating and analyzing SBOMs (SPDX or CycloneDX) and using software composition analysis tools.
• Hands-on penetration testing of network services, web interfaces, or APIs, with tools such as Burp Suite, Nmap, or Metasploit.

Responsibilities

• Own intake, triage, and tracking of reported vulnerabilities from CVE feeds, scanners, customers, and researchers.
• Assess exploitability and impact on products, and recommend next steps: patch, mitigate, or document as not affected.
• Drive fixes with development teams and track them through to release.
• Produce vulnerability status reports and advisories for engineering and leadership.
• Generate and maintain SBOMs for every product release, covering Android, Linux, and third-party components.
• Automate SBOM generation and vulnerability matching in the build pipeline.
• Support open-source license compliance and third-party component reviews.

Skills

Vulnerability management

SBOM analysis

CI/CD security

Penetration testing

Python scripting

Security reporting

Linux security

Communication

Education

Bachelor's degree in CS, Cybersecurity, or related field

Tools

Burp Suite

Nmap

Metasploit

SonarQube

Grype

Trivy

Semgrep

CodeQL

Job description

At HP, you’ll have a chance to create tools, technology, and solutions that reshape the way the world works in the future. If you’re looking to join a company that allows you to connect with a network of professionals eager to support you in doing your best work, we want to talk to you. Our legendary culture guides every employee toward success—fostering collaboration and driving innovation.

Operating in over 170 countries, HP is always creating new services, products, and capabilities giving you more opportunities to advance your career. Here, innovation is the key to professional development and career mobility.

When you join HP, you’re joining a company that believes every voice matters and that we all deserve a seat at the table. From the boardroom to factory floor, we create a culture where everyone is respected and where people can be themselves. You will be part of a global laboratory where different perspectives and experiences will help you solve problems in new ways. This is where you can build a long and wide-ranging career.

About the role

The Security Platform Engineer owns the reusable platform capabilities that embed security and compliance into our development and delivery workflows. You will build and run the security tooling, test environments, and processes that keep our Android- and Linux-based devices secure, from code scanning in CI to penetration testing on real hardware.

You will own our vulnerability management process end to end: generating SBOMs, triaging reported vulnerabilities, assessing their impact on our products, and driving fixes through to release. You will report to the Platform Engineering manager and work closely with the Infrastructure & Automation Technical Lead, product development teams, and HP security.

About the team

Platform Engineering builds and runs the developer platform behind Poly Video products, built on PolyOS, our Android-based OS. We own the path from commit to validated release: source control, CI/CD, build compute and storage, artifact management, and automated testing.

Key tools and technologies you'll work with:

• GitHub Enterprise and GitHub Actions
• Python
• Android and Linux builds
• SBOM and vulnerability scanning tools
• Static analysis and code scanning (SonarQube)
• Penetration testing and network analysis tools
• Docker, Proxmox, and VM infrastructure

What you'll do

Vulnerability management

• Own intake, triage, and tracking of reported vulnerabilities, from CVE feeds, scanners, customers, and researchers
• Assess exploitability and impact on our products, and recommend next steps: patch, mitigate, or document as not affected
• Drive fixes with development teams and track them through to release
• Produce vulnerability status reports and advisories for engineering and leadership

SBOM and software composition

• Generate and maintain SBOMs for every product release, covering Android, Linux, and third-party components
• Automate SBOM generation and vulnerability matching in the build pipeline
• Support open-source license compliance and third-party component reviews

Security in the development pipeline

• Build reusable GitHub Actions workflows for static analysis, dependency scanning, and secrets detection
• Define and enforce security gates on pull requests and release builds
• Tune scanners to reduce noise so developers act on real findings

Device security testing

• Design and maintain isolated penetration testing environments for our devices
• Perform hands-on penetration testing of devices, network services, web interfaces, and APIs
• Automate recurring security tests and integrate them with our hardware test lab
• Report findings clearly, with severity, reproduction steps, and remediation guidance

Compliance

• Support EU Cyber Resilience Act readiness, including SBOM and vulnerability-handling obligations
• Support FIPS and Common Criteria certification efforts with evidence, testing, and documentation
• Partner with HP security teams on policy, audits, and coordinated disclosure

Required qualifications

• Bachelor's degree in Computer Science, Cybersecurity, or a related field
• 4+ years in product security, application security, DevSecOps, or security engineering
• Hands-on vulnerability management: CVE triage, CVSS scoring, exploitability assessment, and remediation tracking
• Experience generating and analyzing SBOMs (SPDX or CycloneDX) and using software composition analysis tools
• Hands-on penetration testing of network services, web interfaces, or APIs, with tools such as Burp Suite, Nmap, or Metasploit
• Python scripting for security automation
• Experience integrating security scanning into CI/CD pipelines (GitHub Actions or similar)
• Clear written communication, including findings reports for both engineers and leadership

Preferred qualifications

• Android platform security: SELinux policy, verified boot, app sandboxing, and Android security bulletins
• Embedded or IoT device security testing, including hardware interfaces (UART, JTAG) and firmware analysis
• Experience with EU Cyber Resilience Act, FIPS 140-3, or Common Criteria
• Strong Linux skills, including networking, services, and system hardening
• SBOM and vulnerability tools such as Syft, Grype, Trivy, Dependency-Track, or Black Duck
• Static analysis and code scanning tools such as SonarQube, CodeQL, or Semgrep
• Fuzzing tools and techniques (AFL++, libFuzzer, or protocol fuzzers)
• Experience with VEX statements and coordinated vulnerability disclosure
• Security certifications such as OSCP, GPEN, GWAPT, or CISSP

Salary Range: $111,400-$161,550

Compensation & Benefits (Full-Time Employees)

The salary range for this role is listed above. Final salary offered is based upon multiple factors including individual job-related qualifications, education, experience, knowledge and skills.

At HP, we offer a competitive and comprehensive benefits package, including:

• Health insurance
• Vision insurance
• Long term/short term disability insurance
• Employee assistance program
• Flexible spending account
• Life insurance
• Generous time off policies, including;
  • 4-12 weeks fully paid parental leave based on tenure
  • 11 paid holidays
  • Additional flexible paid vacation and sick leave ( US benefits overview )

When you join HP, you’re investing in your future—and so are we. You have priorities beyond work. That’s why we offer flexibility, support, and benefits that help you shape the life you want.

Equal Opportunity Employer (EEO) Statement