Top Cybersecurity Jobs in Boston, MA

Manages a product and application security team, develops secure coding programs, integrates security scanning into CI/CD pipelines, analyzes vulnerabilities, supports incident response, conducts threat modeling and security assessments, and mentors engineering teams on secure software development and cloud security practices.

Own security risk identification, quantification, prioritization, and remediation across third-party risk, assessments, and security findings. Maintain risk registers, reporting, metrics, and remediation tracking while partnering with technical and business stakeholders. Lead AI risk management for ISO 42001 certification and build automation, scripting, and AI-enabled tools to improve GRC workflows. Monitor emerging risks, frameworks, regulations, and threat trends, communicating business-relevant risk insights to leadership.

Leads Enterprise Security services, setting and enforcing security standards across identity, endpoints, business applications, cloud infrastructure, networking, IoT, and automation. Partners with IT, SOC, vulnerability management, governance, and threat operations teams to secure applications, monitor environments, manage EDR policies, remediate vulnerabilities, assess risks, and maintain compliance. Also drives AI security initiatives and uses AI tools to improve enterprise security capabilities and team efficiency.

Lead OT security monitoring and triage operations, investigate suspicious activity across industrial networks, tune detections, manage vulnerabilities and asset classification, and escalate findings to incident responders and threat hunters. Produce customer-facing reports, support platform operations, mentor analysts, and collaborate across cybersecurity teams. The role requires shift-based coverage, remote coordination, and expertise in network security with a strong interest in ICS/OT environments.

Own multi-year identity security adoption roadmaps for strategic enterprise accounts. Architect governance across human, machine, and AI agent identities; advise C-suite and engineering leaders; translate regulations into security architectures; quantify breach-risk reduction, compliance gains, and cost avoidance; support renewals and expansions; synthesize cross-account patterns for product and engineering teams; contribute thought leadership and mentor advisors.

Leads security assurance and compliance transformation for a regulated payments and lending platform. Owns continuous controls monitoring, automated evidence collection, enterprise security and third-party risk, business continuity governance, assurance evidence, and second-line independent reviews. Manages and develops the security compliance team while partnering with engineering and customer trust functions to scale automated compliance across PCI, SOC, SOX, and ISO frameworks.

Supports customers using Rapid7’s Vector Command Red Team service through attack surface analysis, reconnaissance, OSINT, reporting, customer communications, and request prioritization. The role coordinates with Red Team, MDR, and MVM teams; conducts manual network and service reconnaissance; develops scripts to analyze attack surface data; monitors customer exposures; and performs entry-level external penetration testing. It also includes customer onboarding, monthly reporting, update calls, and translating technical security concepts for nontechnical stakeholders.

Conduct application security assessments, discover and validate vulnerabilities, analyze complex codebases, build custom security tooling, perform threat modeling and architecture reviews, and deliver actionable findings to clients. Independently own assessment workstreams, develop proof-of-concept exploits, communicate technical conclusions, review team work, and contribute to security research, open-source tools, and technical writing.

Build and lead a scalable application security and secure SDLC program across engineering teams. Establish policies, standards, tooling, vulnerability management, threat modeling, developer enablement, security champions, software supply-chain controls, and executive reporting. Partner with development, platform, DevOps, product, and leadership teams to integrate security into CI/CD, source control, build, release, and deployment workflows while supporting audits, advisories, incident response, and regulatory requirements.

Operate application security across the SDLC, including secure design, code reviews, threat modeling, API security, DevSecOps tooling, CI/CD security gates, cloud and container security, vulnerability management, and risk communication. Partner with engineering teams on secure coding standards, AWS, Kubernetes, Terraform, mobile ecosystems, and responsible AI integration. Participate in an on-call rotation and develop scalable security platforms, paved roads, documentation, and developer training.