Top Cybersecurity Jobs in Boston, MA

Lead and scale multiple product security engineering teams while defining security strategy, secure SDLC standards, identity and authentication capabilities, vulnerability management, DevSecOps tooling, cloud security, privacy by design, and threat modeling. Partner across engineering, product, legal, compliance, and enterprise security; mentor leaders and staff-level contributors; and foster a collaborative culture focused on secure, reliable software delivery.

Lead cybersecurity, AI, and technology risk assessments across systems, cloud environments, business processes, and initiatives. Maintain the enterprise cyber risk register, track mitigation plans, translate technical findings into business risks, support FAIR-based quantitative analysis, and prepare executive reporting. Partner with Security, Legal, Product, IT, and business teams to assess architectures, AI use cases, emerging technologies, and third-party integrations while strengthening GRC processes and operational resilience.

Lead governance, risk, and compliance activities for AI/ML systems, LLM integrations, AI agents, and related vendors. Conduct AI risk and third-party assessments, map controls to frameworks, manage remediation, support audits, develop AI-specific policies, report risk metrics, monitor regulatory developments, and coordinate incident governance with Legal, Security, Product, and Engineering teams.

Leads cross-functional security, GRC, and IT security initiatives from planning through delivery. Manages security portfolios, roadmaps, dependencies, risks, governance, and stakeholder communications. Builds executive dashboards, KPIs, KRIs, and reporting using data from Jira, Confluence, GRC platforms, and other systems. Administers Jira and Confluence, improves workflows and automation, and partners with technical, compliance, legal, privacy, and business teams to support audits and operational excellence.

Leads enterprise Security Engineering and Security Operations strategy, teams, technical standards, roadmaps, and measurable outcomes. Oversees detection and response, incident readiness, security automation, identity, cloud, endpoint, SaaS, data protection, and AI security. Manages significant incidents, security partners, organizational design, hiring, and cross-functional collaboration while developing managers, engineers, and analysts. Partners with the CISO to strengthen security posture and operational performance in a sensitive-data technology environment.

Build and mature WHOOP’s Security Architecture practice by establishing governance, standards, reference architectures, and reusable security patterns. Provide architectural guidance across application, cloud, infrastructure, API, identity, networking, AI, and enterprise systems. Lead threat modeling and architecture reviews, assess vendor security, translate compliance requirements into engineering controls, mentor teams, document guidance, and advise leaders on security strategy and risk-based decisions.

Lead the design, execution, and continuous improvement of WHOOP’s GRC program. Responsibilities include managing security controls and compliance frameworks, enterprise and third-party risk assessments, incident response documentation, GRC intake and prioritization, executive reporting, operational metrics, and process improvement. The role also mentors GRC analysts and partners with Legal, Security, Product, and IT to support regulatory compliance, reduce enterprise risk, and strengthen operational resilience.

Supports the governance, risk, and compliance program by managing third-party vendor risk assessment intakes, reviews, reassessments, remediation tracking, and cross-functional follow-up. The role analyzes ticketing and intake data to identify workflow trends, handoff gaps, recurring questions, and opportunities to improve guidance, reporting, templates, automation, and stakeholder experience. It also assists with third-party risk program management and escalates issues with informed recommendations.

Designs and scales high-fidelity security detections across cloud, identity, endpoint, network, and application environments. Develops Detection-as-Code rules aligned with MITRE ATT&CK, translates threat intelligence into detections, and validates coverage through adversary emulation. Tunes alerts, reduces false positives, automates enrichment and triage, tracks detection KPIs, supports incident investigations, participates in on-call rotations, and partners with engineering, infrastructure, product, IT, and GRC teams. Applies analytics and machine learning to improve detection fidelity and investigation workflows.

Lead enterprise security incident response as the primary escalation point and incident commander. Investigate, contain, and remediate threats across hosts, cloud environments, logs, identity systems, SIEM, and EDR tools while coordinating with the SOC, IT, GRC, and Legal. Maintain response playbooks, conduct post-incident reviews and tabletop exercises, support breach assessments and regulatory notifications, track incident metrics, and improve detection and response capabilities. Participate in an after-hours on-call rotation.