Senior Information Security Engineer

Editas Medicine•Cambridge, MA

About The Position

The Senior Information Security Engineer will enable Editas Medicine to operate with confidence by engineering a resilient, scalable, and proactive security posture that protects sensitive scientific, clinical, and corporate data. Over the next 12 - 18 months, this role must further design and mature enterprise‑grade security controls, elevate threat detection and response capabilities, and embed security into technology decisions across the organization ensuring Editas can innovate safely and at speed. This role drives the development and execution of security controls across cloud, on‑premises, and hybrid environments, ensuring strong alignment with business objectives, regulatory requirements, and industry best practices. Working closely with IT leadership and cross‑functional partners, the Senior Information Security Engineer leads initiatives in threat detection and response, identity and access management, vulnerability management, network and endpoint security, and security automation. This position serves as a subject‑matter expert and escalation point for complex security challenges, providing both strategic guidance and hands‑on engineering expertise. The ideal candidate brings deep technical proficiency, strong analytical instincts, and the ability to influence security decisions across a fast‑paced, high‑growth environment. This role offers the opportunity to shape the organization’s security posture, manage technical teams, and drive continuous improvement in a mission‑critical function.

Requirements

8–10+ years of experience in information security, security engineering, or related technical fields.
Deep knowledge of network security, cloud security (AWS, Azure), and identity security (IAM, SSO, MFA, Zero Trust).
Hands on experience with SIEM, EDR/XDR, firewalls, vulnerability scanners, email security, and cloud native security tools.
Strong understanding of threat detection, incident response, and forensics fundamentals.
Proficiency in scripting/automation (Python, PowerShell).
Familiarity with secure development practices and common vulnerabilities (OWASP Top 10, SANS Top 25).
Excellent communication and leadership skills.
Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or equivalent experience.

Nice To Haves

Experience with security architecture frameworks and enterprise‑scale design.
Background in threat intelligence, malware analysis, or red/blue team operations/tabletop exercises.
Familiarity with compliance frameworks such as SOC 2, PCI‑DSS, HIPAA, or GDPR.
Advanced certifications preferred: CISSP, GCIH, GCIA, OSCP, CCSP, Cloud security certifications (AWS/Azure/GCP).

Responsibilities

Lead the design and implementation of enterprise‑grade security controls, including network security, cloud security, endpoint protection, and identity platforms.
Architect secure solutions for new technologies, cloud migrations, and infrastructure modernization efforts.
Evaluate and integrate advanced security tools, automation frameworks, and detection technologies.
Oversee security monitoring, threat hunting, and incident response activities.
Conduct deep‑dive investigations into complex security events and coordinate cross‑functional response efforts.
Lead vulnerability assessments, penetration testing coordination, and remediation tracking.
Develop and refine detection logic, playbooks, and response workflows.
Perform and lead risk assessments, threat modeling, and security reviews for applications, systems, and vendors.
Contribute to the development and enforcement of security policies, standards, and best practices aligned with frameworks like NIST, ISO 27001, and CIS.
Partner with compliance teams on audits, regulatory requirements, and remediation plans.
Drive continuous improvement of security processes, tooling, and operational efficiency.
Manage and oversee security engineers at our MSP and serve as a subject‑matter expert across the organization.
Foster collaboration between IT and business functions (e.g., Genomics & Bioinformatics, Finance, HR, etc.) to establish a culture of security.
Communicate complex security issues to technical and non‑technical stakeholders, including leadership.