Product Security Engineer

Function Engineering Our Company We’re Hitachi Vantara, the data foundation trusted by the world’s innovators. Our resilient, high-performance data infrastructure means that customers – from banks to theme parks ­– can focus on achieving the incredible with data.    If you’ve seen the Las Vegas Sphere, you’ve seen just one example of how we empower businesses to automate, optimize, innovate – and wow their customers. Right now, we’re laying the foundation for our next wave of growth.  We’re looking for people who love being part of a diverse, global team – and who get excited about making a real-world impact with data. Job description Product Security Engineer Role Summary The Product Security Engineer strengthens Hitachi Vantara's product security across the Software Development Lifecycle (SDLC), driving vulnerability management, security assessments, remediation, Secure SDLC, and DevSecOps initiatives in collaboration with Engineering, Product, Cloud Operations, Support, and Security teams. Key Responsibilities 1. Product Security Expertise Develop understanding of product architecture, technology stacks, APIs, integrations, and deployment models; act as the primary security contact for Engineering, Product, and Support teams. Identify product security risks and support security assessments and customer escalations. Familiarity with NFS, SMB, LDAP, Active Directory, Kerberos, TLS/SSH, PKI, REST API security, access controls, Amazon S3, tenant isolation, Kubernetes RBAC, secrets management, and encryption. 2. Security Triage & Vulnerability Management Perform vulnerability triage, reproduction, validation, and risk assessment using CVSS, exploitability, and business/customer impact. Lead vulnerability identification, prioritization, remediation, and reporting across SAST, DAST, SCA, penetration tests, bug bounty programs, and customer-reported issues. Establish remediation SLAs, track findings to closure, validate fixes, and drive root cause analysis and corrective actions. 3. Secure Software Development & DevSecOps Promote Secure SDLC and secure coding practices across Java, Python, Node.js, .NET, and cloud-native applications. Develop security standards, conduct code reviews, validate fixes, and guide engineering teams on sustainable remediation. Integrate security controls and scanning tools into CI/CD pipelines, automate security validation, and promote shift-left practices. Support security implementation across Kubernetes, Docker, containers, IaC, and cloud-native deployment pipelines. 4. Incident Response & Governance Investigate and remediate product security incidents, conduct root cause analysis, and recommend preventive controls. Collaborate with Engineering, Cloud Operations, Support, and Security teams during incident response. Support SOC 2, ISO 27001, NIST, CIS, customer security assessments, audits, evidence collection, and remediation tracking.