Senior Security Engineer

PathAI•Boston, MA

2d•$127,500 - $195,500

About The Position

PathAI is seeking a Senior Security Engineer to embed security into how engineers design, build, and ship software. The role focuses on making secure development easier by reducing friction in identifying, prioritizing, and resolving cybersecurity issues through tooling, automation, and secure-by-default practices. The engineer will champion secure coding across Python and JavaScript codebases; partner with engineering teams on design reviews, threat modeling, and code reviews; and build internal tools, automation, and paved-road patterns such as secure libraries, CI/CD guardrails, pre-commit checks, and self-service workflows. The role also owns and improves security tooling throughout the SDLC, including SAST, DAST, SCA and dependency scanning, secrets detection, and container and IaC scanning. The position works with product, infrastructure, machine learning, IT, clinical, QA, and regulatory teams to secure PathAI's AWS- and Kubernetes-based cloud-native SaaS platform, support data integrity and protection of sensitive health data, and meet industry standards and audit and inspection readiness expectations. It includes improving security issue triage and remediation, upholding engineering standards, mentoring teammates, and delivering secure coding guidance and training. This is a remote position or a hybrid position based in Boston, Massachusetts. Relocation benefits are not available. The expected salary range for the Boston primary location is $127,500–$195,500; actual pay depends on experience, qualifications, geographic location, and other job-related factors permitted by law.

Requirements

Bachelor of Science in Computer Science, Software Engineering, Cybersecurity, or a closely related technical field.
At least 5 years of full life cycle development and/or application security engineering experience.
Strong hands-on understanding of secure coding practices and common vulnerability classes, such as OWASP Top 10 and CWE, and ability to explain risks and fixes to developers.
Demonstrated experience building tools and automation that improve developer workflows, ideally in Python.
Demonstrated experience integrating security tooling, including SAST, DAST, SCA, secrets scanning, and container scanning, into CI/CD pipelines.
Ability to take on complex tasks, learn quickly, and work proactively.
Ability to collaborate with a distributed team and work autonomously on projects; problem-solving skills and ability to work in a fast-paced, agile environment.
Strong interpersonal and communication skills, including the ability to attend client-facing meetings and explain technical concepts to non-experts.
Demonstrated experience with a cloud platform, specifically AWS.

Nice To Haves

Experience managing cybersecurity and risk in a controlled or regulated environment, such as FDA-regulated medical device software, IEC 62304, ISO 13485, ISO 27001, NIST, SOC 2, or HIPAA.
An advanced degree or relevant security certification, such as OSCP, GWAPT, CSSLP, or CISSP.
Experience in healthtech, including working with HL7, HL7 FHIR, or DICOM.
Experience with threat modeling, vulnerability management programs, and risk-based prioritization of findings.
Hands-on experience with CI/CD tools such as GitLab CI.
Knowledge of containerization technologies such as Docker and orchestration tools such as Kubernetes, including how to secure them.
Knowledge of an IaC framework such as Terraform and experience applying policy-as-code or IaC security scanning.
Experience with cloud security tooling and practices, including IAM, network segmentation, logging and monitoring, and CSPM.
Excellent organizational skills and the ability to prioritize and manage multiple projects efficiently.

Responsibilities

Champion secure coding practices across Python and JavaScript codebases, partnering with engineering teams through design reviews, threat modeling, and code review.
Design and build internal tools, automation, and paved-road patterns, including secure libraries, CI/CD guardrails, pre-commit checks, and self-service workflows.
Own and continuously improve SDLC security tooling, including SAST, DAST, SCA and dependency scanning, secrets detection, and container and IaC scanning; tune tools to maximize signal and minimize noise.
Streamline cybersecurity issue triage, tracking, and remediation, making findings actionable, well-prioritized, and integrated into tools engineers use, including GitLab, Orca, AWS GuardDuty, Jira, and Bugbounty.
Collaborate with product, infrastructure, machine learning, and IT teams to secure the cloud-native SaaS platform on AWS and Kubernetes.
Drive and uphold engineering standards, promote consistency across codebases and pipelines, and ensure security controls are reviewed, tested, and integrated.
Mentor teammates, deliver secure coding guidance and training, and share technical knowledge.
Contribute to platform reliability, data integrity, protection of sensitive health data, and compliance with industry standards.
Collaborate with clinical, QA, and regulatory teams to ensure security activities meet validation expectations and support audits and inspection readiness.