Security Platform Engineer - Poly

About HP At HP, you’ll have a chance to create tools, technology, and solutions that reshape the way the world works in the future. If you’re looking to join a company that allows you to connect with a network of professionals eager to support you in doing your best work, we want to talk to you. Our legendary culture guides every employee toward success—fostering collaboration and driving innovation. Operating in over 170 countries, HP is always creating new services, products, and capabilities giving you more opportunities to advance your career. Here, innovation is the key to professional development and career mobility. When you join HP, you’re joining a company that believes every voice matters and that we all deserve a seat at the table. From the boardroom to factory floor, we create a culture where everyone is respected and where people can be themselves. You will be part of a global laboratory where different perspectives and experiences will help you solve problems in new ways. This is where you can build a long and wide-ranging career. About the role The Security Platform Engineer owns the reusable platform capabilities that embed security and compliance into our development and delivery workflows. You will build and run the security tooling, test environments, and processes that keep our Android- and Linux-based devices secure, from code scanning in CI to penetration testing on real hardware. You will own our vulnerability management process end to end: generating SBOMs, triaging reported vulnerabilities, assessing their impact on our products, and driving fixes through to release. You will report to the Platform Engineering manager and work closely with the Infrastructure & Automation Technical Lead, product development teams, and HP security. About the team Platform Engineering builds and runs the developer platform behind Poly Video products, built on PolyOS, our Android-based OS. We own the path from commit to validated release: source control, CI/CD, build compute and storage, artifact management, and automated testing. Key tools and technologies you'll work with: • GitHub Enterprise and GitHub Actions • Python • Android and Linux builds • SBOM and vulnerability scanning tools • Static analysis and code scanning (SonarQube) • Penetration testing and network analysis tools • Docker, Proxmox, and VM infrastructure What you'll do Vulnerability management • Own intake, triage, and tracking of reported vulnerabilities, from CVE feeds, scanners, customers, and researchers • Assess exploitability and impact on our products, and recommend next steps: patch, mitigate, or document as not affected • Drive fixes with development teams and track them through to release • Produce vulnerability status reports and advisories for engineering and leadership SBOM and software composition • Generate and maintain SBOMs for every product release, covering Android, Linux, and third-party components • Automate SBOM generation and vulnerability matching in the build pipeline • Support open-source license compliance and third-party component reviews Security in the development pipeline • Build reusable GitHub Actions workflows for static analysis, dependency scanning, and secrets detection • Define and enforce security gates on pull requests and release builds • Tune scanners to reduce noise so developers act on real findings Device security testing • Design and maintain isolated penetration testing environments for our devices • Perform hands-on penetration testing of devices, network services, web interfaces, and APIs • Automate recurring security tests and integrate them with our hardware test lab • Report findings clearly, with severity, reproduction steps, and remediation guidance Compliance • Support EU Cyber Resilience Act readiness, including SBOM and vulnerability-handling obligations • Support FIPS and Common Criteria certification efforts with evidence, testing, and documentation • Partner with HP security teams on policy, audits, and coordinated disclosure Required qualifications • Bachelor's degree in Computer Science, Cybersecurity, or a related field • 4+ years in product security, application security, DevSecOps, or security engineering • Hands-on vulnerability management: CVE triage, CVSS scoring, exploitability assessment, and remediation tracking • Experience generating and analyzing SBOMs (SPDX or CycloneDX) and using software composition analysis tools • Hands-on penetration testing of network services, web interfaces, or APIs, with tools such as Burp Suite, Nmap, or Metasploit • Python scripting for security automation • Experience integrating security scanning into CI/CD pipelines (GitHub Actions or similar) • Clear written communication, including findings reports for both engineers and leadership Preferred qualifications • Android platform security: SELinux policy, verified boot, app sandboxing, and Android security bulletins • Embedded or IoT device security testing, including hardware interfaces (UART, JTAG) and firmware analysis • Experience with EU Cyber Resilience Act, FIPS 140-3, or Common Criteria • Strong Linux skills, including networking, services, and system hardening • SBOM and vulnerability tools such as Syft, Grype, Trivy, Dependency-Track, or Black Duck • Static analysis and code scanning tools such as SonarQube, CodeQL, or Semgrep • Fuzzing tools and techniques (AFL++, libFuzzer, or protocol fuzzers) • Experience with VEX statements and coordinated vulnerability disclosure • Security certifications such as OSCP, GPEN, GWAPT, or CISSP Salary Range: $111,400-$161,550 Compensation & Benefits (Full-Time Employees) The salary range for this role is listed above. Final salary offered is based upon multiple factors including individual job-related qualifications, education, experience, knowledge and skills. At HP, we offer a competitive and comprehensive benefits package, including: • Health insurance