Security Engineer

Security Engineer

  

This role has been designed as ‘’Onsite’ with an expectation that you will primarily work from an HPE office.

Who We Are:

Hewlett Packard Enterprise is the global edge-to-cloud company advancing the way people live and work. We help companies connect, protect, analyze, and act on their data and applications wherever they live, from edge to cloud, so they can turn insights into outcomes at the speed required to thrive in today’s complex world. Our culture thrives on finding new and better ways to accelerate what’s next. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good. If you are looking to stretch and grow your career our culture will embrace you. Open up opportunities with HPE.

Job Description:

   

Team Description

This position is a Security Engineer role on the Compute & Cloud Services Engineering organization (CCSE). CCSE is responsible for building and operating software that supports HPE server hardware. We maintain a collection of system management products that we either operate as a SaaS or license to our customers. We’re part of the Compute business unit which is responsible for selling and supporting server hardware.

Job Description
The Security Engineer is a role for a moderately experienced engineer that can work independently with mentors and other technical experts to manage our security, compliance tooling, and related processes. They need to be highly organized and skilled at security scanning, SBOM generation, compliance, and 
auditing. The position is a critical role in the organization and has ample opportunities for exposure across teams and up to leadership. The ideal candidate will have a passion for security and relish the continual improvement of our security processes to protect HPE and their customers and grow their career path.

Responsibilities specific to this role include:
Implementing security tooling and integrating them into automated build pipelines

Working with leadership on compliance and audit reporting and evidence collection including SOC2 Type 2 ,CSA, CAIQ and internal HPE controls

Managing security tooling and configuring them to meet organizational goals

Providing data, reporting, and tracking that will hold development and infrastructure teams responsible for resolution of compliance and security vulnerabilities.

Coordinate with internal resources and external vendors for penetration testing of HPE applications

Periodic on-call shifts

Required Skills

• Typically 4-7 years experience
• Bachelor's or master's degree in computer science, engineering, information systems, or closely related quantitative discipline, or comparable work experience
• Critical thinking and problem solving
• Experience managing vulnerability tracking and remediation for AWS infrastructure, Java applications, Python applications, Go applications, and on-prem infrastructure
• Experience reporting on security and compliance related data and appropriately tailoring reports to both technical and executive audiences
• Experience using security and compliance tooling like Wiz, Trivy, AWS Security Hub
• Understanding of REST interfaces and how to build automated workflows around security and compliance tooling using tools like Python
• Proven experience decomposing complicated processes and re-designing them for simplicity and speed
• Experience with Git version control
• Understanding of NIST CSF, RMF, SSDF and 800-53 controls
• Ability to address the OWASP Top 10 risks for Large Language Models (LLMs) and implement post-quantum cryptography across multiple products

Nice-to-have Skills

• Experience programming in Python or Go
• Experience managing Kubernetes
• Experience building Github Actions or using Jenkins for CI/CD orchestration
• Experience with Wiz
• Experience with Trivy
• Experience with WebInspect, Nessus, Qualys, or Burp
• Experience navigating the organizational dynamics and complexities of large enterprises
• Experience with vulnerability tracking of Java applications and their dependencies

About our products
HPE sells a lot of server hardware. We build software to help our customers manage that hardware. Our 
Compute Ops Management (COM) SaaS product helps admins get their hardware up-and-running quickly 
while keeping them patched and uniformly configured.
Our COM Secure Gateway product compliments COM and gives customers a more secure way to connect 
their servers to COM.
Finally, OneView is our ma