Top Remote Security Engineer Jobs in Boston, MA

Secure Runpod’s multitenant GPU cloud infrastructure across bare-metal and virtualized environments. Responsibilities include designing workload and network isolation, hardening Linux kernels and container platforms, testing hypervisor and hardware security, developing low-level controls in C, Go, or Rust, securing GPU and PCIe interactions, and responding to infrastructure security incidents with forensic capabilities for ephemeral containers.

Own application security for backend services, APIs, cloud infrastructure, and edge systems handling financial transactions. Responsibilities include validating red-team findings, assigning severity, hardening services, implementing WAF and rate-limiting defenses, creating automated security configuration checks, expanding pull-request security gates, reviewing architectures, managing attack-surface coverage, and evaluating security tools. The role also partners with engineers and Security Operations to drive effective remediation.

Owns Cleo’s application and product security strategy across SaaS and customer-hosted products. Responsibilities include maturing the SSDLC, threat modeling, security scanning, vulnerability triage, penetration testing, coordinated disclosure, CVE management, product security controls, customer-facing advisories, and NIST CSF evidence. The role also leads security enablement, roadmap prioritization, AI security reviews, and hands-on exploit reproduction and patch validation while guiding engineers and security partners.

Build and automate security controls across bare-metal Linux infrastructure and AWS. Responsibilities include host hardening, vulnerability and patch management, container and CI/CD security, penetration testing, detection and incident response, access and log reviews, compliance evidence automation, and software supply-chain security. The role also supports customer security work and applies AI tooling to security operations.

Lead and evolve the insider threat program by engineering detection, automating investigation workflows, tuning UEBA/SIEM/DLP/UAM/SOAR detection content, conducting threat hunting and DFIR, collaborating with HR/Legal, and using data analytics (e.g., Pandas) to investigate anomalous activity and reduce internal risk.

Conduct application security assessments, discover and validate vulnerabilities, analyze complex codebases, build custom security tooling, perform threat modeling and architecture reviews, and deliver actionable findings to clients. Independently own assessment workstreams, develop proof-of-concept exploits, communicate technical conclusions, review team work, and contribute to security research, open-source tools, and technical writing.

Conduct application security assessments, discover and validate vulnerabilities, analyze code and architectures, perform threat modeling, build security tooling, and develop proof-of-concept exploits. Own scoped assessment components from discovery through client delivery, communicate findings and remediation guidance, and contribute to security research, open-source tools, and technical documentation. The role requires hands-on coding, vulnerability research, memory-corruption knowledge, operating-system familiarity, and independent technical investigation.

Operate application security across the SDLC, including secure design, code reviews, threat modeling, API security, DevSecOps tooling, CI/CD security gates, cloud and container security, vulnerability management, and risk communication. Partner with engineering teams on secure coding standards, AWS, Kubernetes, Terraform, mobile ecosystems, and responsible AI integration. Participate in an on-call rotation and develop scalable security platforms, paved roads, documentation, and developer training.

Lead insider risk detection engineering and investigations using EDR/XDR, UEBA, SIEM, and SOAR tools. Refine detection rules, reduce alert noise, close coverage gaps, manage investigations, develop playbooks, document evidence, mentor analysts, and collaborate discreetly with HR, Legal, business leaders, and executives. The role also requires investigative workflow automation using Python or JavaScript and ownership of scalable security processes.

Lead security architecture and design reviews, define standards for protecting sensitive healthcare data, build automated defenses, guide security monitoring and incident response, translate complex objectives into engineering requirements, and mentor engineers through code and design reviews.

Assess product and application architectures, develop threat models, identify security risks, and guide engineering teams on remediation. Promote security culture through training, mentoring, vulnerability management, and internal security initiatives. Build security tooling, automation, patterns, and workflows that embed secure-by-design practices across engineering. Partner with product managers, designers, and engineers to secure complex, large-scale cloud systems.

Protect corporate data through DLP implementation, tuning, alert review, false-positive reduction, and control optimization across web, endpoint, email, cloud, and SaaS environments. The engineer will review data protection programs, improve monitoring and blocking controls, collaborate with business partners, and use automation and emerging AI tools to strengthen security operations.

Lead Affirm’s enterprise AI security review program, threat model LLM and agentic systems, review code and configurations, and develop security guardrails, tooling, policies, and monitoring. Evaluate AI-enabled SaaS vendors, identify emerging vulnerabilities, support incident response, and lead cross-functional initiatives across Security, Engineering, Legal, Privacy, and Compliance. The role requires expertise in AI security architecture, threat modeling, IAM, cloud infrastructure, policy-as-code, and regulated enterprise environments.

Own and execute the application security program, including SIEM management, threat detection, architecture and code reviews, vulnerability management, security testing, incident response, forensic investigations, and security tooling. Partner with engineering and infrastructure teams to remediate vulnerabilities, promote secure coding, develop training, and improve enterprise security through cloud, container, compliance, and monitoring practices.

Partners with engineering teams to identify and remediate product security risks across the software development lifecycle. Responsibilities include threat modeling, secure architecture and coding guidance, security testing, vulnerability prioritization, penetration testing coordination, bug bounty remediation, application monitoring, developer training, and secure deployment practices. The role also advances AI-assisted security tooling, DevSecOps practices, security champions, Kubernetes and container security, and scalable risk-based remediation frameworks.

Assists with designing, implementing, monitoring, configuring, and maintaining information security and risk management infrastructure. Supports requirements definition, root cause analysis, technical training, project delivery, compliance, and security systems administration. The role requires familiarity with operating systems, software administration, network security technologies, endpoint protection, firewalls, encryption, SIEM, DLP, and relevant security frameworks and regulations.

Owns compliance documentation and security control narratives for an Agentic AI platform. Responsibilities include authoring System Security Plans, managing POA&Ms, coordinating audit evidence, supporting RMF and ATO activities, maintaining policies and SOPs, and partnering with cloud, platform, and security engineers. The role validates that documentation reflects implemented infrastructure and supports CMMC, FedRAMP, DoD, and NIST-aligned compliance efforts.

Owns GitLab’s security policy and standards lifecycle, including drafting, approvals, exceptions, attestations, regulatory alignment, framework mapping, audits, and adherence measurement. Translates emerging regulations into actionable requirements, supports customer trust activities, and automates governance and evidence workflows using AI. Provides technical and program leadership across Security, Product, Legal, and Engineering while mentoring team members and shaping the security governance roadmap.

Owns end-to-end security engineering, including risk identification, secure-by-default libraries, least-privilege guardrails, developer machine hardening, supply-chain security, and identity and authentication protections. Partners with compliance to implement effective controls for healthcare requirements such as HIPAA and HITRUST. The role requires production software engineering and security expertise, with broad autonomy in a fully remote environment.

Designs, implements, maintains, and improves cybersecurity controls across enterprise systems, networks, cloud environments, and applications. Deploys and troubleshoots security technologies, responds to incidents, identifies security requirements, supports audits and change management, documents procedures, analyzes risks, and delivers remediation recommendations. Collaborates with architects, project managers, engineers, and stakeholders to protect organizational data and infrastructure while automating repeatable security tasks.

Secure Microsoft Windows online services through offensive security, code and deployment reviews, penetration testing, vulnerability research, and scalable mitigation development. Build reusable security review tools and agents, demonstrate exploit impact, identify novel attack vectors, bypass security controls, and collaborate with product engineering teams to strengthen architecture and defenses.

Lead end-to-end red team and adversary emulation operations across cloud, identity, network, endpoint, hardware, and operational security environments. Develop offensive tooling, implants, and AI-driven autonomous agents for reconnaissance, exploitation, and post-exploitation. Serve as a technical lead for customer engagements, brief security executives, collaborate with blue teams and threat intelligence organizations, establish operational standards, and mentor senior operators.

Lead end-to-end red team and adversary emulation operations across cloud, identity, network, endpoint, hardware, and operational environments. Develop offensive tooling, implants, and tradecraft; direct AI-driven autonomous agents; discover and exploit vulnerabilities; brief executive customers; provide defensive guidance; collaborate with threat intelligence and blue teams; establish operational standards; and mentor security operators.

Identify and remediate vulnerabilities across products and AWS infrastructure, respond to security incidents, close security tickets, integrate security controls into CI/CD, review code and infrastructure, support SOC 2 and CASA compliance, and strengthen access management, secrets handling, and cloud hardening.

Own security risk identification, quantification, prioritization, and remediation across third-party risk, assessments, and security findings. Maintain risk registers, reporting, metrics, and remediation tracking while partnering with technical and business stakeholders. Lead AI risk management for ISO 42001 certification and build automation, scripting, and AI-enabled tools to improve GRC workflows. Monitor emerging risks, frameworks, regulations, and threat trends, communicating business-relevant risk insights to leadership.