Sr. Product Security Response Engineer

Sr. Product Security Response Engineer This role has been designed as 'Hybrid' with a requirement that you will work on average 2 days per week from an HPE office. Who We Are: Hewlett Packard Enterprise is the global edge-to-cloud company advancing the way people live and work. We help companies connect, protect, analyze, and act on their data and applications wherever they live, from edge to cloud, so they can turn insights into outcomes at the speed required to thrive in today’s complex world. Our culture thrives on finding new and better ways to accelerate what’s next. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good. If you are looking to stretch and grow your career our culture will embrace you. Open up opportunities with HPE. Job Description: About our cybersecurity team Are you ready to make an impact at one of the world’s leading tech companies? HPE’s Cybersecurity team is where you can do just that! We’re looking for a dynamic and experienced GRC specialist to join our Cybersecurity team. If you’re passionate about shaping the future of cybersecurity and ready for your next challenge, we’d love to hear from you. As a Cybersecurity GRC Platform Architect, you will design, configure, integrate, and enhance the technology capabilities supporting cybersecurity governance, risk, compliance, and third-party risk management. You will translate complex requirements into scalable workflows, reliable data, actionable reporting, and practical automation. You will independently deliver complex platform solutions, recommend technical approaches, and partner with cybersecurity, risk, compliance, policy, and IT teams. You will also establish reusable technical patterns and provide guidance to platform users and less-experienced contributors. What You’ll Do Responsibilities: Product Security Response Owning and driving complex product vulnerability cases from initial intake through technical resolution and disclosure readiness, maintaining clear status, evidence, decisions, ownership, and next actions. Triaging vulnerability reports for credibility, scope, affected products or versions, exploitability, potential customer impact, duplication, and completeness of supporting evidence. Reproducing reported vulnerabilities and validating proofs of concept in collaboration with product engineering, penetration testing, security research, and other technical specialists. Coordinating technical investigations with product teams, resolving information gaps, aligning on responsibilities, and keeping cases moving toward remediation and disclosure milestones. Assessing vulnerability severity using applicable scoring methods and available technical evidence while documenting assumptions, rationale, and unresolved questions. Supporting the development, review, and technical quality of customer-facing security advisories, vulnerability disclosures, remediation guidance, and related content. Engaging internal stakeholders and external vulnerability reporters or coordination partners to clarify findings, gather evidence, communicate status, and support coordinated disclosure. Applying knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices to support accurate classification and reporting. Monitoring case queues and emerging demand, identifying cases at risk of delay, and helping maintain consistent execution across PSRT operating areas. Contributing across diverse product environments and adapting to differences in architecture, development practices, and organizational ownership. Vulnerability Investigation and Security Validation Performing hands-on technical analysis to reproduce vulnerabilities, validate exploitability, determine affected configurations or versions, and assess potential impact. Reviewing proof-of-concept code, logs, source code, configurations, system behavior, product architecture, and other evidence relevant to vulnerability investigations. Developing or adapting scripts, test harnesses, proofs of concept, and technical methods needed to validate findings and support remediation decisions. Conducting targeted security testing when vulnerability reports require deeper technical analysis or independent validation beyond the information submitted. Partnering directly with product engineering teams to understand product design, validate findings, support remediation, and perform retesting as appropriate. Producing clear technical findings that describe evidence, affected components, reproduction steps, security impact, and actionable remediation guidance. Defining investigation and testing approaches based on product architecture, threat models, reported vulnerabilities, known attack techniques, and areas of highest security risk. Distinguishing confirmed vulnerabilities from false positives, unsupported claims, configuration issues, or findings that require additional evidence. Escalating investigations to appropriate specialists when cases require expertise beyond the role’s technical domain. PSRT Process and Capability Improvement Identifying recurring vulnerability patterns, operational friction, process gaps, and opportunities to improve PSRT guidance, playbooks, templates, and technical practices. Contributing reusable scripts, tooling, integrations, and automation that reduce repetitive work and improve the consistency or quality of vulnerability response. Helping improve case documentation, evidence requirements, review practices, and quality checks across the response lifecycle. Supporting improvements to vulnerability intake, triage, reproduction, severity assessment, remediation coordination, advisory preparation, and case closure. Capturing reusable techniques and lessons learned so future investigations can be completed more efficiently and consistently. Using approved automation or AI-assisted capabilities where they provide practical value while validating outputs and preserving accountable human judgment. Measuring the effectiveness of process or tooling improvements and adjusting approaches based on operational results and team feedback. Technical Collaboration and Leadership Leading significant vulnerability investigations or focused technical workstreams while remaining directly involved in hands-on execution. Providing technical guidance to engineers, case managers, and product teams on vulnerability analysis, evidence quality, severity assessment, remediation, and disclosure readiness. Reviewing technical findings, investigation approaches, and security communications for accuracy, completeness, and actionable guidance. Communicating complex findings, risks, tradeoffs, and recommendations clearly to engineering teams, security specialists, product leaders, and other stakeholders. Building productive working relationships across product engineering, PSRT, penetration testing, security research, and adjacent security teams. Mentoring less-experienced team members and sharing practical knowledge that strengthens the broader team’s vulnerability-response capability. Representing PSRT in cross-functional discussions and helping stakeholders reach evidence-based technical decisions. What you need to bring: Education and Experience Requirements Bachelor’s or Master’s degree in computer science, cybersecurity, information systems, engineering, or a related field, or equivalent practical experience. Typically 8 to 10 years of relevant experience in product security response, application security, vulnerability management, penetration testing, incident response, security engineering, or closely related technical work. Demonstrated experience independently managing complex vulnerability investigations across multiple products, platforms, or technical environments. Strong ability to analyze vulnerability reports, proof-of-concept code, logs, source code, configurations, system architectures, and other technical evidence. Hands-on experience reproducing vulnerabilities, validating exploitability, assessing impact, and supporting remediation or retesting. Working knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices. Experience authoring or reviewing security advisories, vulnerability disclosures, technical findings, or remediation guidance. Experience with Python or another scripting or programming language used to support security analysis, testing, or workflow automation. Familiarity with APIs, source control, CI/CD pipelines, containers, cloud environments, or modern software delivery practices. Strong knowledge of common software weaknesses, secure coding practices, threat modeling, and secure development lifecycle principles. Ability to lead significant technical work, exercise independent judgment, coordinate across teams, and influence decisions without relying on formal authority. Strong analytical, technical writing, and communication skills across engineering, security, product, and leadership audiences. Preferred Qualifications Experience working in a PSIRT or PSRT supporting enterprise technology products or services. Experience engaging vulnerability reporters, product engineering teams, disclosure partners, or vulnerability-coordination communities. Demonstrated experience planning and performing targeted penetration tests or security assessments in support of vulnerability investigations. Experience investigating vulnerabilities affecting applications, services, APIs, cloud environments, firmware, operating systems, networking products, or supporting infrastructure. Experience developing scripts, test harnesses, proofs of concept, integrations, or workflow automation for security operations. Familiarity with vulnerability management platforms, case-management systems, security-advisory publishing processes, or machine-readable advisory formats. Expe