Sr. Principal Security Engineer

Sr. Principal Security Engineer

This role has been designed as ‘Hybrid’ with an expectation that you will work on average 2 days per week from an HPE office.

Job Description:

Within HPE, our Operations, Legal and Admin teams work across the business, providing visible accountability and measurable outcomes. With a variety of roles and responsibilities these teams really connect the dots, giving us the essential insights, support and capability to accelerate our transformation to be the world’s edge to cloud company. Join us redefine what’s next for you.

Summary

The Principal AI Security Engineer is a strategic role responsible for safeguarding the organization’s transition to an autonomous, AI‑driven future. This position combines established application security practices with specialized defensive strategies for generative AI and agent‑based systems. By defining and implementing a comprehensive AI security framework aligned with OWASP Top 10 for LLMs and MITRE ATLAS, the role ensures that innovation in AI is delivered with strong security and safety guarantees.

This role focuses on agentic security and MCP server integrity, securing environments where autonomous agents access and process sensitive data. Through continuous adversarial testing and proactive threat modeling, the Principal AI Security Engineer identifies and mitigates emerging risks such as prompt injection, data poisoning, and model abuse before they can be exploited. Ultimately, this role establishes a security‑as‑code foundation that enables the organization to deploy AI systems with resilience, trustworthiness, and scale.

What you'll do:

• Develop an AI risk assessment framework and codify technical guidelines to mitigate LLM bias, hallucinations, and toxic outputs.

• Design and secure autonomous AI agents, including RAG architectures, with deep‑dive threat modeling and adversarial testing.

• Establish secure authentication, authorization, and audit protocols for AI communication frameworks (e.g., MCP).

• Assess and guide the secure adoption of AI capabilities across enterprise applications, focusing on data security, access controls, and model input/output handling.

• Automate security gates to verify model provenance, pipeline integrity, and misconfigurations across the ML and software supply chain.

• Integrate security practices throughout the SDLC in close partnership with engineering and DevOps teams.

• Promote secure coding standards, tooling, automation, and mentor teams through secure development and pipeline practices.

• Design, implement, and maintain security controls within CI/CD platforms (GitHub Actions, Jenkins, GitLab, Azure DevOps).

• Ensure software integrity through code signing, artifact validation, provenance, SBOM generation, and dependency scanning.

• Automate SAST, DAST, SCA, container, and AI‑specific vulnerability scanning in build and release pipelines to detect insecure LLM orchestration patterns.

• Identify and remediate misconfigurations, secrets exposure, and access control gaps in CI/CD and pipeline environments.

• Design, deploy, and tune WAF rules and API security protections; conduct API risk assessments and promote secure API design patterns.

• Perform secure code reviews and expand automated security testing coverage across pipelines and deployed services.

• Triage, prioritize, and track vulnerabilities across source code, pipelines, and production services.

• Facilitate threat modeling for applications, APIs, delivery pipelines, and AI‑driven features.

• Expand security automation for API discovery, secrets detection, and dependency risk management.

• Act as a trusted advisor to product, platform, and DevOps teams by translating technical risk into business impact.

• Support the Security Champions program.

• Partner with SOC and Incident Response teams during software supply chain, pipeline, or AI‑related security incidents.

• Leverage AI‑powered security tools to detect anomalies, code risks, and CI/CD misconfigurations.

What you need to bring

Required

• 10–15+ years of experience in Application Security, Product Security, or Secure Software Development.

• Hands‑on experience securing LLMs, AI agents, and MCP servers, with familiarity with OWASP Top 10 for LLM Applications and MITRE ATLAS.

• Strong hands‑on experience with CI/CD pipelines and source repositories (GitHub, GitLab, Jenkins, etc.).

• Knowledge of software supply chain security frameworks (e.g., SLSA, NIST SSDF), including build integrity, artifact signing (Sigstore, Cosign), and secrets management.

• Strong background in WAF tuning, API security, and vulnerability identification and remediation.

• Proficiency in at least one programming language (Python, Java, Go, or JavaScript/Node.js).

• Experience with automated security testing tools, including SAST, DAST, SCA, and container scanning.

• Cloud security experience in AWS, Azure, or GCP environments.

• Strong understanding of OWASP Top 10 (Web & API), CWE, and secure coding practices.

Preferred

• Experience integrating SBOM generation and software composition analysis (SCA) into CI/CD workflows.

• Knowledge of runtime protection and detection tools, including API security platforms, RASP, and container EDR solutions.

• Experience with GitOps practices, infrastructure‑as‑code (Terraform, CloudFormation), and policy‑as‑code, including security scanning.

• Background in handling software supply chain attacks, including dependency poisoning and compromise incidents.

• Relevant security certifications such as OSWE, CSSLP, GPCS, GWEB, or GCSA.

Soft Skills

• Excellent communication and the ability to influence developers, DevOps engineers, and leadership.

• Strong problem-solving skills with an automation-first mindset.

• Collaborative and outcome-oriented, able to balance security with delivery velocity.

#legal&admin

Accountability, Accountability, Action Planning, Active Learning, Active Listening, Agile Methodology, Bias, Business, Coaching, Creativity, Critical Thinking, Cybersecurity, Data Analysis Management, Data Collection Management (Inactive), Data Controls, Design Thinking, Development Methodologies, Empathy, Follow-Through, Growth Mindset, Implementation Methodologies, Infrastructure Design, Intellectual Curiosity (Inactive), Long Term Planning, Managing Ambiguity {+ 4 more}

Health & Wellbeing

We strive to provide our team members and their loved ones with a comprehensive suite of benefits that supports their physical, financial and emotional wellbeing.

Personal & Professional Development

We also invest in your career because the better you are, the better we all are. We have specific programs catered to helping you reach any career goals you have — whether you want to become a knowledge expert in your field or apply your skills to another division.

Unconditional Inclusion

We are unconditionally inclusive in the way we work and celebrate individual uniqueness. We know varied backgrounds are valued and succeed here. We have the flexibility to manage our work and personal needs. We make bold moves, together, and are a force for good.

#india

Job:

Information Technology

Job Level:

TCP_06

    

    

Hewlett Packard Enterprise is EEO Protected Veteran/ Individual with Disabilities.

HPE will comply with all applicable laws related to employer use of arrest and conviction records, including laws requiring employers to consider for employment qualified applicants with criminal histories.

   

No Fees Notice & Recruitment Fraud Disclaimer

 

It has come to HPE’s attention that there has been an increase in recruitment fraud whereby scammer impersonate HPE or HPE-authorized recruiting agencies and offer fake employment opportunities to candidates.  These scammers often seek to obtain personal information or money from candidates.

 

Please note that Hewlett Packard Enterprise (HPE), its direct and indirect subsidiaries and affiliated companies, and its authorized recruitment agencies/vendors will never charge any candidate a registration fee, hiring fee, or any other fee in connection with its recruitment and hiring process.  The credentials of any hiring agency that claims to be working with HPE for recruitment of talent should be verified by candidates and candidates shall be solely responsible to conduct such verification. Any candidate/individual who relies on the erroneous representations made by fraudulent employment agencies does so at their own risk, and HPE disclaims liability for any damages or claims that may result from any such communication.