Sr. Product Security Response Engineer

Hewlett Packard Enterprise is seeking a Sr. Product Security Response Engineer to join their Cybersecurity team. As a Cybersecurity GRC Platform Architect, you will design, configure, integrate, and enhance technology capabilities supporting cybersecurity governance, risk, compliance, and third-party risk management.

Responsibilities:

• Own and drive complex product vulnerability cases from initial intake through technical resolution and disclosure readiness
• Triage vulnerability reports for credibility, scope, affected products or versions, exploitability, potential customer impact, duplication, and completeness of supporting evidence
• Reproduce reported vulnerabilities and validate proofs of concept in collaboration with product engineering, penetration testing, security research, and other technical specialists
• Coordinate technical investigations with product teams, resolve information gaps, align on responsibilities, and keep cases moving toward remediation and disclosure milestones
• Assess vulnerability severity using applicable scoring methods and available technical evidence while documenting assumptions, rationale, and unresolved questions
• Support the development, review, and technical quality of customer-facing security advisories, vulnerability disclosures, remediation guidance, and related content
• Engage internal stakeholders and external vulnerability reporters or coordination partners to clarify findings, gather evidence, communicate status, and support coordinated disclosure
• Apply knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices to support accurate classification and reporting
• Monitor case queues and emerging demand, identify cases at risk of delay, and help maintain consistent execution across PSRT operating areas
• Contribute across diverse product environments and adapt to differences in architecture, development practices, and organizational ownership

Vulnerability Investigation and Security Validation:

• Perform hands-on technical analysis to reproduce vulnerabilities, validate exploitability, determine affected configurations or versions, and assess potential impact
• Review proof-of-concept code, logs, source code, configurations, system behavior, product architecture, and other evidence relevant to vulnerability investigations
• Develop or adapt scripts, test harnesses, proofs of concept, and technical methods needed to validate findings and support remediation decisions
• Conduct targeted security testing when vulnerability reports require deeper technical analysis or independent validation beyond the information submitted
• Partner directly with product engineering teams to understand product design, validate findings, support remediation, and perform retesting as appropriate
• Produce clear technical findings that describe evidence, affected components, reproduction steps, security impact, and actionable remediation guidance
• Define investigation and testing approaches based on product architecture, threat models, reported vulnerabilities, known attack techniques, and areas of highest security risk
• Distinguish confirmed vulnerabilities from false positives, unsupported claims, configuration issues, or findings that require additional evidence
• Escalate investigations to appropriate specialists when cases require expertise beyond the role's technical domain

PSRT Process and Capability Improvement:

• Identify recurring vulnerability patterns, operational friction, process gaps, and opportunities to improve PSRT guidance, playbooks, templates, and technical practices
• Contribute reusable scripts, tooling, integrations, and automation that reduce repetitive work and improve the consistency or quality of vulnerability response
• Help improve case documentation, evidence requirements, review practices, and quality checks across the response lifecycle
• Support improvements to vulnerability intake, triage, reproduction, severity assessment, remediation coordination, advisory preparation, and case closure
• Capture reusable techniques and lessons learned so future investigations can be completed more efficiently and consistently
• Use approved automation or AI-assisted capabilities where they provide practical value while validating outputs and preserving accountable human judgment
• Measure the effectiveness of process or tooling improvements and adjust approaches based on operational results and team feedback

Technical Collaboration and Leadership:

• Lead significant vulnerability investigations or focused technical workstreams while remaining directly involved in hands-on execution
• Provide technical guidance to engineers, case managers, and product teams on vulnerability analysis, evidence quality, severity assessment, remediation, and disclosure readiness
• Review technical findings, investigation approaches, and security communications for accuracy, completeness, and actionable guidance
• Communicate complex findings, risks, tradeoffs, and recommendations clearly to engineering teams, security specialists, product leaders, and other stakeholders
• Build productive working relationships across product engineering, PSRT, penetration testing, security research, and adjacent security teams
• Mentor less-experienced team members and share practical knowledge that strengthens the broader team's vulnerability-response capability
• Represent PSRT in cross-functional discussions and help stakeholders reach evidence-based technical decisions

Requirements:

• Bachelor's or Master's degree in computer science, cybersecurity, information systems, engineering, or a related field, or equivalent practical experience
• Typically 6 to 10 years of relevant experience in product security response, application security, vulnerability management, penetration testing, incident response, security engineering, or closely related technical work
• Demonstrated experience independently managing complex vulnerability investigations across multiple products, platforms, or technical environments
• Strong ability to analyze vulnerability reports, proof-of-concept code, logs, source code, configurations, system architectures, and other technical evidence
• Hands-on experience reproducing vulnerabilities, validating exploitability, assessing impact, and supporting remediation or retesting
• Working knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices
• Experience authoring or reviewing security advisories, vulnerability disclosures, technical findings, or remediation guidance
• Experience with Python or another scripting or programming language used to support security analysis, testing, or workflow automation
• Familiarity with APIs, source control, CI/CD pipelines, containers, cloud environments, or modern software delivery practices
• Strong knowledge of common software weaknesses, secure coding practices, threat modeling, and secure development lifecycle principles
• Ability to lead significant technical work, exercise independent judgment, coordinate across teams, and influence decisions without relying on formal authority
• Strong analytical, technical writing, and communication skills across engineering, security, product, and leadership audiences