{"id":3679877,"url":"https://alion.io/job/hewlett-packard-enterprise-sr-product-security-response-engineer","title":"Sr. Product Security Response Engineer","company":{"id":5292,"name":"Hewlett Packard Enterprise","domain":"hpe.com","url":"https://alion.io/company/hewlett-packard-enterprise","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":84,"open_postings":160,"ghost_share":0,"stale_share":0.656,"repost_share":0.006,"time_to_fill_p50_days":35,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"CVE","optional":false},{"name":"CVSS","optional":false},{"name":"CWE","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-11-03T12:43:55Z","employer_posted_date":"2026-11-03","last_verified_at":"2026-11-10T08:33:39Z","board_verified":true,"closed_at":null,"days_open":7,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":7},"description":"Sr. Product Security Response EngineerThis role has been designed as 'Hybrid' with a requirement that you will work on average 2 days per week from an HPE office.Who We Are:\nHewlett Packard Enterprise is the global edge-to-cloud company advancing the way people live and work. We help companies connect, protect, analyze, and act on their data and applications wherever they live, from edge to cloud, so they can turn insights into outcomes at the speed required to thrive in today’s complex world. Our culture thrives on finding new and better ways to accelerate what’s next. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good. If you are looking to stretch and grow your career our culture will embrace you. Open up opportunities with HPE.\nJob Description:\nAbout our cybersecurity team\nAre you ready to make an impact at one of the world’s leading tech companies? HPE’s Cybersecurity team is where you can do just that! We’re looking for a dynamic and experienced GRC specialist to join our Cybersecurity team. If you’re passionate about shaping the future of cybersecurity and ready for your next challenge, we’d love to hear from you.\nAs a Cybersecurity GRC Platform Architect, you will design, configure, integrate, and enhance the technology capabilities supporting cybersecurity governance, risk, compliance, and third-party risk management. You will translate complex requirements into scalable workflows, reliable data, actionable reporting, and practical automation.\nYou will independently deliver complex platform solutions, recommend technical approaches, and partner with cybersecurity, risk, compliance, policy, and IT teams. You will also establish reusable technical patterns and provide guidance to platform users and less-experienced contributors.\nWhat You’ll Do\nResponsibilities:\nProduct Security Response\nOwning and driving complex product vulnerability cases from initial intake through technical resolution and disclosure readiness, maintaining clear status, evidence, decisions, ownership, and next actions.\nTriaging vulnerability reports for credibility, scope, affected products or versions, exploitability, potential customer impact, duplication, and completeness of supporting evidence.\nReproducing reported vulnerabilities and validating proofs of concept in collaboration with product engineering, penetration testing, security research, and other technical specialists.\nCoordinating technical investigations with product teams, resolving information gaps, aligning on responsibilities, and keeping cases moving toward remediation and disclosure milestones.\nAssessing vulnerability severity using applicable scoring methods and available technical evidence while documenting assumptions, rationale, and unresolved questions.\nSupporting the development, review, and technical quality of customer-facing security advisories, vulnerability disclosures, remediation guidance, and related content.\nEngaging internal stakeholders and external vulnerability reporters or coordination partners to clarify findings, gather evidence, communicate status, and support coordinated disclosure.\nApplying knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices to support accurate classification and reporting.\nMonitoring case queues and emerging demand, identifying cases at risk of delay, and helping maintain consistent execution across PSRT operating areas.\nContributing across diverse product environments and adapting to differences in architecture, development practices, and organizational ownership.\nVulnerability Investigation and Security Validation\nPerforming hands-on technical analysis to reproduce vulnerabilities, validate exploitability, determine affected configurations or versions, and assess potential impact.\nReviewing proof-of-concept code, logs, source code, configurations, system behavior, product architecture, and other evidence relevant to vulnerability investigations.\nDeveloping or adapting scripts, test harnesses, proofs of concept, and technical methods needed to validate findings and support remediation decisions.\nConducting targeted security testing when vulnerability reports require deeper technical analysis or independent validation beyond the information submitted.\nPartnering directly with product engineering teams to understand product design, validate findings, support remediation, and perform retesting as appropriate.\nProducing clear technical findings that describe evidence, affected components, reproduction steps, security impact, and actionable remediation guidance.\nDefining investigation and testing approaches based on product architecture, threat models, reported vulnerabilities, known attack techniques, and areas of highest security risk.\nDistinguishing confirmed vulnerabilities from false positives, unsupported claims, configuration issues, or findings that require additional evidence.\nEscalating investigations to appropriate specialists when cases require expertise beyond the role’s technical domain.\nPSRT Process and Capability Improvement\nIdentifying recurring vulnerability patterns, operational friction, process gaps, and opportunities to improve PSRT guidance, playbooks, templates, and technical practices.\nContributing reusable scripts, tooling, integrations, and automation that reduce repetitive work and improve the consistency or quality of vulnerability response.\nHelping improve case documentation, evidence requirements, review practices, and quality checks across the response lifecycle.\nSupporting improvements to vulnerability intake, triage, reproduction, severity assessment, remediation coordination, advisory preparation, and case closure.\nCapturing reusable techniques and lessons learned so future investigations can be completed more efficiently and consistently.\nUsing approved automation or AI-assisted capabilities where they provide practical value while validating outputs and preserving accountable human judgment.\nMeasuring the effectiveness of process or tooling improvements and adjusting approaches based on operational results and team feedback.\nTechnical Collaboration and Leadership\nLeading significant vulnerability investigations or focused technical workstreams while remaining directly involved in hands-on execution.\nProviding technical guidance to engineers, case managers, and product teams on vulnerability analysis, evidence quality, severity assessment, remediation, and disclosure readiness.\nReviewing technical findings, investigation approaches, and security communications for accuracy, completeness, and actionable guidance.\nCommunicating complex findings, risks, tradeoffs, and recommendations clearly to engineering teams, security specialists, product leaders, and other stakeholders.\nBuilding productive working relationships across product engineering, PSRT, penetration testing, security research, and adjacent security teams.\nMentoring less-experienced team members and sharing practical knowledge that strengthens the broader team’s vulnerability-response capability.\nRepresenting PSRT in cross-functional discussions and helping stakeholders reach evidence-based technical decisions.\nWhat you need to bring:\nEducation and Experience Requirements\nBachelor’s or Master’s degree in computer science, cybersecurity, information systems, engineering, or a related field, or equivalent practical experience.\nTypically 6 to 10 years of relevant experience in product security response, application security, vulnerability management, penetration testing, incident response, security engineering, or closely related technical work.\nDemonstrated experience independently managing complex vulnerability investigations across multiple products, platforms, or technical environments.\nStrong ability to analyze vulnerability reports, proof-of-concept code, logs, source code, configurations, system architectures, and other technical evidence.\nHands-on experience reproducing vulnerabilities, validating exploitability, assessing impact, and supporting remediation or retesting.\nWorking knowledge of CVE, CWE, CVSS, MITRE, NVD, FIRST, and coordinated vulnerability disclosure practices.\nExperience authoring or reviewing security advisories, vulnerability disclosures, technical findings, or remediation guidance.\nExperience with Python or another scripting or programming language used to support security analysis, testing, or workflow automation.\nFamiliarity with APIs, source control, CI/CD pipelines, containers, cloud environments, or modern software delivery practices.\nStrong knowledge of common software weaknesses, secure coding practices, threat modeling, and secure development lifecycle principles.\nAbility to lead significant technical work, exercise independent judgment, coordinate across teams, and influence decisions without relying on formal authority.\nStrong analytical, technical writing, and communication skills across engineering, security, product, and leadership audiences.\nPreferred Qualifications\nExperience working in a PSIRT or PSRT supporting enterprise technology products or services.\nExperience engaging vulnerability reporters, product engineering teams, disclosure partners, or vulnerability-coordination communities.\nDemonstrated experience planning and performing targeted penetration tests or security assessments in support of vulnerability investigations.\nExperience investigating vulnerabilities affecting applications, services, APIs, cloud environments, firmware, operating systems, networking products, or supporting infrastructure.\nExperience developing scripts, test harnesses, proofs of concept, integrations, or workflow automation for security operations.\nFamiliarity with vulnerability management platforms, case-management systems, security-advisory publishing processes, or machine-readable advisory formats.\nExperience supporting high-impact or broadly disclosed vulnerabilities involving complex product ownership or cross-organizational coordination.\nRelevant security, cloud, application security, or software engineering certifications are valued but not required.\nWhat Success Looks Like\nComplex vulnerability cases are technically sound, well documented, and moved forward with clear ownership, timely stakeholder engagement, and evidence-based decisions.\nProduct teams receive actionable findings, credible severity and impact assessments, and practical support through remediation and retesting.\nSecurity advisories and vulnerability disclosures are accurate, consistent, complete, and ready for customer communication.\nInvestigations distinguish genuine product risk from false positives, incomplete reports, unsupported claims, and configuration-specific issues.\nPSRT casework becomes more consistent and efficient through improved playbooks, templates, technical methods, tooling, and knowledge sharing.\nAutomation reduces repetitive work and improves response quality without weakening technical validation, traceability, or accountability.\nCross-functional investigations remain coordinated, risks and delays are identified early, and cases continue progressing toward resolution.\nLess-experienced team members grow through practical mentoring, technical review, and shared investigation experience.\nAccessibility\nHPE is committed to creating an inclusive and accessible workplace and encourages applications from all qualified individuals, including those with disabilities. If you believe you require accommodation during any stage of the application or interview process, please submit your request by completing our secure form linked here.\nNote: This option is reserved for applicants needing assistance/reasonable accommodation related to a disability.\nWhat We Can Offer You:\nHealth & Wellbeing\nWe strive to provide our team members and their loved ones with a comprehensive suite of benefits that supports their physical, financ...","description_format":"text","description_chars":14820,"description_truncated":true,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Platforms (IaaS & PaaS)","Information Security","Network Equipment","High-Performance Computing"],"lifecycle":[{"event":"open","at":"2026-11-03T12:43:55Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":6,"expected_fill_days":35,"reasons":["conf:4","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-10T06:52:35Z"},"pay":null,"html_url":"https://alion.io/job/hewlett-packard-enterprise-sr-product-security-response-engineer","json_url":"https://alion.io/job/hewlett-packard-enterprise-sr-product-security-response-engineer.json","meta":{"generated_at":"2026-11-10T14:15:46Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33123,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5292},"rest":"https://alion.io/mcp/rest/get_company?id=5292"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhewlett-packard-enterprise-sr-product-security-response-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhewlett-packard-enterprise-sr-product-security-response-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhewlett-packard-enterprise-sr-product-security-response-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/hewlett-packard-enterprise-sr-product-security-response-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhewlett-packard-enterprise-sr-product-security-response-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3679877}},{"tool":"search_jobs","arguments":{"company":"hpe.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3679877},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}