Senior Security Engineer

Role overview

Help engineering teams build and ship software securely by embedding security practices into development workflows and creating tools that reduce friction. The role covers application security and cloud-native infrastructure, with responsibility for improving vulnerability handling while protecting sensitive health data and supporting regulated product work.

Responsibilities - Partner with developers on secure design reviews, threat modeling, code review, and secure coding practices across Python and JavaScript applications. - Build automation, secure libraries, pipeline safeguards, and self-service patterns that make secure development the default. - Operate and tune security checks across the development lifecycle, including code, dependency, secrets, container, and infrastructure scanning. - Improve how findings are prioritized, tracked, and resolved by integrating actionable security information into engineering workflows. - Work with product, infrastructure, machine learning, IT, clinical, quality, and regulatory teams to secure cloud services and support audits and validation. - Mentor colleagues and share guidance on secure engineering practices.

Requirements - Bachelor’s degree in computer science, software engineering, cybersecurity, or a closely related field. - At least five years of full lifecycle software development or application security experience. - Hands-on knowledge of secure coding and common vulnerability classes, with the ability to explain risks and fixes to developers. - Experience building developer-focused security tools or automation, ideally using Python. - Experience integrating security scanning into CI/CD pipelines. - AWS experience, strong communication skills, and the ability to work independently with distributed teams.

Nice to have - Security or risk experience in regulated environments, healthcare technology, or standards-based programs. - Advanced degree or security certification; experience with threat modeling and risk-based vulnerability management. - Familiarity with Kubernetes, Docker, Terraform, policy as code, cloud security controls, and CI/CD systems. - Knowledge of healthcare data standards such as HL7, FHIR, or DICOM.

Benefits and work setup - Remote or hybrid work based in Boston, Massachusetts. Relocation support is not available.