# Sr. Product Security Response Engineer **Company**: Hewlett Packard Enterprise **Location**: Bengaluru, Karnātaka **Work arrangement**: hybrid **Experience**: senior **Job type**: full-time **Category**: Security **Industry**: Technology **Apply**: https://hpe.wd5.myworkdayjobs.com/en-US/Jobsathpe/job/Bengaluru-Karntaka-India/Sr-Product-Security-Response-Engineer_1218157-2?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_c5c4abf9-9e9 ## Description Hewlett Packard Enterprise is seeking a Sr. Product Security Response Engineer to join their Cybersecurity team. As a Cybersecurity GRC Platform Architect, you will design, configure, integrate, and enhance technology capabilities supporting cybersecurity governance, risk, compliance, and third-party risk management. **Responsibilities:** - Own and drive complex product vulnerability cases from initial intake through technical resolution and disclosure readiness - Triage vulnerability reports for credibility, scope, affected products or versions, exploitability, potential customer impact, duplication, and completeness of supporting evidence - Reproduce reported vulnerabilities and validate proofs of concept in collaboration with product engineering, penetration testing, security research, and other technical specialists - Coordinate technical investigations with product teams, resolve information gaps, align on responsibilities, and keep cases moving toward remediation and disclosure milestones - Assess vulnerability severity using applicable scoring methods and available technical evidence while documenting assumptions, rationale, and unresolved questions - Support the development, review, and technical quality of customer-facing security advisories, vulnerability disclosures, remediation guidance, and related content - Engage internal stakeholders and external vulnerability reporters or coordination partners to clarify findings, gather evidence, communicate status, and support coordinated disclosure - Apply knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices to support accurate classification and reporting - Monitor case queues and emerging demand, identify cases at risk of delay, and help maintain consistent execution across PSRT operating areas - Contribute across diverse product environments and adapt to differences in architecture, development practices, and organizational ownership **Vulnerability Investigation and Security Validation:** - Perform hands-on technical analysis to reproduce vulnerabilities, validate exploitability, determine affected configurations or versions, and assess potential impact - Review proof-of-concept code, logs, source code, configurations, system behavior, product architecture, and other evidence relevant to vulnerability investigations - Develop or adapt scripts, test harnesses, proofs of concept, and technical methods needed to validate findings and support remediation decisions - Conduct targeted security testing when vulnerability reports require deeper technical analysis or independent validation beyond the information submitted - Partner directly with product engineering teams to understand product design, validate findings, support remediation, and perform retesting as appropriate - Produce clear technical findings that describe evidence, affected components, reproduction steps, security impact, and actionable remediation guidance - Define investigation and testing approaches based on product architecture, threat models, reported vulnerabilities, known attack techniques, and areas of highest security risk - Distinguish confirmed vulnerabilities from false positives, unsupported claims, configuration issues, or findings that require additional evidence - Escalate investigations to appropriate specialists when cases require expertise beyond the role's technical domain **PSRT Process and Capability Improvement:** - Identify recurring vulnerability patterns, operational friction, process gaps, and opportunities to improve PSRT guidance, playbooks, templates, and technical practices - Contribute reusable scripts, tooling, integrations, and automation that reduce repetitive work and improve the consistency or quality of vulnerability response - Help improve case documentation, evidence requirements, review practices, and quality checks across the response lifecycle - Support improvements to vulnerability intake, triage, reproduction, severity assessment, remediation coordination, advisory preparation, and case closure - Capture reusable techniques and lessons learned so future investigations can be completed more efficiently and consistently - Use approved automation or AI-assisted capabilities where they provide practical value while validating outputs and preserving accountable human judgment - Measure the effectiveness of process or tooling improvements and adjust approaches based on operational results and team feedback **Technical Collaboration and Leadership:** - Lead significant vulnerability investigations or focused technical workstreams while remaining directly involved in hands-on execution - Provide technical guidance to engineers, case managers, and product teams on vulnerability analysis, evidence quality, severity assessment, remediation, and disclosure readiness - Review technical findings, investigation approaches, and security communications for accuracy, completeness, and actionable guidance - Communicate complex findings, risks, tradeoffs, and recommendations clearly to engineering teams, security specialists, product leaders, and other stakeholders - Build productive working relationships across product engineering, PSRT, penetration testing, security research, and adjacent security teams - Mentor less-experienced team members and share practical knowledge that strengthens the broader team's vulnerability-response capability - Represent PSRT in cross-functional discussions and help stakeholders reach evidence-based technical decisions **Requirements:** - Bachelor's or Master's degree in computer science, cybersecurity, information systems, engineering, or a related field, or equivalent practical experience - Typically 6 to 10 years of relevant experience in product security response, application security, vulnerability management, penetration testing, incident response, security engineering, or closely related technical work - Demonstrated experience independently managing complex vulnerability investigations across multiple products, platforms, or technical environments - Strong ability to analyze vulnerability reports, proof-of-concept code, logs, source code, configurations, system architectures, and other technical evidence - Hands-on experience reproducing vulnerabilities, validating exploitability, assessing impact, and supporting remediation or retesting - Working knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices - Experience authoring or reviewing security advisories, vulnerability disclosures, technical findings, or remediation guidance - Experience with Python or another scripting or programming language used to support security analysis, testing, or workflow automation - Familiarity with APIs, source control, CI/CD pipelines, containers, cloud environments, or modern software delivery practices - Strong knowledge of common software weaknesses, secure coding practices, threat modeling, and secure development lifecycle principles - Ability to lead significant technical work, exercise independent judgment, coordinate across teams, and influence decisions without relying on formal authority - Strong analytical, technical writing, and communication skills across engineering, security, product, and leadership audiences ## Skills ### Required - Python - CVE - CWE - CVSS - MITRE - NVD - FIRST - coordinated vulnerability disclosure practices - scripting - programming - APIs - source control - CI/CD pipelines - containers - cloud environments - modern software delivery practices - common software weaknesses - secure coding practices - threat modeling - secure development lifecycle principles ### Nice to have - experience working in a PSIRT or PSRT - engaging vulnerability reporters - product engineering teams - disclosure partners - vulnerability-coordination communities - planning and performing targeted penetration tests - security assessments - investigating vulnerabilities affecting applications - services - firmware - operating systems - networking products - supporting infrastructure - developing scripts - test harnesses - proofs of concept - integrations - workflow automation - vulnerability management platforms - case-management systems - security-advisory publishing processes - machine-readable advisory formats - high-impact or broadly disclosed vulnerabilities - complex product ownership - cross-organizational coordination --- Source: [Apply at hpe.wd5.myworkdayjobs.com](https://hpe.wd5.myworkdayjobs.com/en-US/Jobsathpe/job/Bengaluru-Karntaka-India/Sr-Product-Security-Response-Engineer_1218157-2?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)