Senior Security Engineer

PathAI•Boston, MA

About The Position

PathAI is seeking a Senior Security Engineer to embed security into how engineers design, build, and ship software. The role focuses on reducing friction in identifying, prioritizing, and resolving cybersecurity issues by building tools, automation, and secure development patterns that help engineers work securely without slowing down. The engineer will champion secure coding across Python and JavaScript codebases and partner with engineering teams through design reviews, threat modeling, and code reviews. The role owns and improves security tooling throughout the software development lifecycle, including SAST, DAST, SCA and dependency scanning, secrets detection, and container and infrastructure-as-code scanning. It also streamlines issue triage, tracking, and remediation, integrating actionable findings into tools such as GitLab, Orca, AWS GuardDuty, Jira, and Bugbounty. The engineer collaborates with product, infrastructure, machine learning, IT, clinical, QA, and regulatory teams to secure PathAI’s cloud-native SaaS platform on AWS and Kubernetes, protect sensitive health data, support reliability and data integrity, and meet compliance, validation, audit, and inspection-readiness expectations. PathAI’s mission is to improve patient outcomes with AI-powered pathology. Its technology supports diagnosis and treatment by applying machine learning and artificial intelligence to histopathology in translational research, pathology labs, and clinical trials. The position may be remote or hybrid in Boston, Massachusetts. Relocation benefits are not available.

Requirements

Bachelor of Science in Computer Science, Software Engineering, Cybersecurity, or a closely related technical field.
At least 5 years of full life cycle development and/or application security engineering experience.
Strong hands-on understanding of secure coding practices and common vulnerability classes, such as OWASP Top 10 and CWE, and ability to explain risks and fixes to developers.
Demonstrated experience building tools and automation that improve developer workflows, ideally in Python.
Demonstrated experience integrating security tooling—including SAST, DAST, SCA, secrets scanning, and container scanning—into CI/CD pipelines.
Ability to take on complex tasks, learn quickly, and work proactively.
Ability to collaborate with a distributed team and work autonomously on projects.
Problem-solving skills and ability to work in a fast-paced, agile environment.
Strong interpersonal and communication skills, including ability to attend client-facing meetings and explain technical concepts to non-experts.
Demonstrated experience with a cloud platform, specifically AWS.

Nice To Haves

Experience managing cybersecurity and risk in a controlled or regulated environment, such as FDA-regulated medical device software, IEC 62304, ISO 13485, ISO 27001, NIST, SOC 2, or HIPAA.
Advanced degree or relevant security certification, such as OSCP, GWAPT, CSSLP, or CISSP.
Experience in healthtech, including work with HL7, HL7 FHIR, or DICOM.
Experience with threat modeling, vulnerability management programs, and risk-based prioritization of findings.
Hands-on experience with CI/CD tools, such as GitLab CI.
Knowledge of Docker and Kubernetes, including how to secure containerization and orchestration technologies.
Knowledge of an IaC framework such as Terraform and experience with policy-as-code or IaC security scanning.
Experience with cloud security tooling and practices, including IAM, network segmentation, logging and monitoring, and CSPM.
Excellent organizational skills and ability to prioritize and manage multiple projects efficiently.

Responsibilities

Embed security into software design, development, and delivery, reducing friction for engineers identifying, prioritizing, and resolving cybersecurity issues.
Champion secure coding practices across Python and JavaScript codebases and partner with engineering teams through design reviews, threat modeling, and code reviews.
Design and build internal security tools, automation, and paved-road patterns such as secure libraries, CI/CD guardrails, pre-commit checks, and self-service workflows.
Own and continuously improve SDLC security tooling, including SAST, DAST, SCA and dependency scanning, secrets detection, and container and IaC scanning; tune tools to maximize signal and minimize noise.
Streamline cybersecurity issue triage, tracking, and remediation, making findings actionable and well-prioritized and integrating them into tools engineers use, including GitLab, Orca, AWS GuardDuty, Jira, and Bugbounty.
Collaborate with product, infrastructure, machine learning, and IT teams to secure the cloud-native SaaS platform on AWS and Kubernetes.
Drive and uphold engineering standards, bring consistency to codebases and pipelines, and ensure security controls are reviewed, tested, and integrated.
Mentor teammates, provide secure coding guidance and training, and share technical knowledge.
Contribute to platform reliability, data integrity, protection of sensitive health data, and compliance with industry standards.
Collaborate with clinical, QA, and regulatory teams so security activities meet validation expectations and support audits and inspection readiness.