Top Remote Security Engineer Jobs in Boston, MA

The role involves leading security initiatives, building security tools, conducting vulnerability assessments, and collaborating with teams to enhance cloud security and risk management.

Perform hands-on application and system security assessments: discover and validate vulnerabilities, develop proof-of-concepts and custom tooling, conduct threat modeling and architecture reviews, and communicate clear remediation guidance to clients while contributing to security research.

Own and architect Forward's security technology stack across AppSec, SecOps, and GRC. Design integrations with Engineering/IT, lead tool evaluations and PoCs, automate controls with infrastructure-as-code and detection-as-code, build centralized logging/SIEM and identity governance, align architecture to security frameworks, mentor security engineers, and support incident response and remediation.

Secure customer-facing products, APIs, and internal services through threat modeling, architecture and code reviews. Remediate vulnerabilities by coding fixes in Python/Go/JS/TS. Build and manage SAST/DAST/SCA security pipelines in CI/CD. Configure WAFs, API gateways, and bot protection. Provide secure coding guidance, run bug bounty triage, and support compliance (SOC 2, ISO 27001, GDPR).

The Staff Security Engineer will lead technical security initiatives, own architectural security decisions, mentor engineers, and align teams on security strategy while ensuring system integrity and compliance.

Lead architecture and scaling of an automated, AI-driven vulnerability detection and remediation platform across cloud, containers, and applications. Correlate SAST/DAST/SCA findings, implement AI-assisted triage, run red/purple team validation, and build automated remediation pipelines integrated into CI/CD for continuous compliance and risk reduction.

The Security Engineer will manage Liftoff's SIEM, lead the adoption of AI-augmented SOC tools, triage alerts, and improve incident response processes while collaborating on various security functions.

Lead cloud and identity security across Snyk's multi-cloud estate (AWS/GCP). Own cloud IAM and least-privilege, CSPM/CNAPP posture, detection and prevention, Kubernetes and enterprise IdP security. Build preventative IaC guardrails, AI/agent automation for remediation and investigations, secure AI adoption and model pipelines, and mentor engineers while participating in on-call rotations and incident response.

Design, deploy, and maintain cloud and edge security across AWS/GCP/Azure including Cloudflare WAF and SASE. Implement zero-trust access, CSPM, IaC security, threat modeling, incident runbooks, detection tuning, and mentor junior engineers while participating in on-call rotation.

Senior technical security engineer responsible for cloud infrastructure security, detection engineering, incident response, application and product security, vulnerability management, penetration test ownership, and security automation. Partners with platform, logistics, and IT teams, manages an application security contractor, and builds tooling to raise the security posture across AWS, IaC, edge, and container environments.

Own and drive product security for the MongoDB Database Server: lead fuzzing, threat modeling, secrets/container security efforts; perform security assessments, POCs, code reviews, and remediation for low-level memory issues; partner with engineering to design controls and educate teams.

Senior security engineer responsible for developing automation and tooling, building and deploying security solutions, conducting incident response and proactive threat hunting, supporting investigations through data analysis, and advising development teams. Must document solutions, participate in agile teams, mentor juniors, and continuously research evolving security threats.

Lead application security for products by performing threat modeling, manual secure code reviews, and penetration testing. Collaborate with engineers to remediate defects, build AppSec automation and tooling, secure cloud/containerized applications, and drive bug-bounty responses to harden platform security.

Perform deep security analysis of endpoint products and sensors: threat modeling, source-code review, exploit-style testing (including kernel components), reproduce/validate bug bounty findings, collaborate with developers to fix vulnerabilities, and build tooling/automation to improve security workflows.

Perform application security assessments across CrowdStrike products: threat modeling, code review, penetration testing, and secure design guidance. Build automation and tooling, respond to bug bounty reports, and collaborate with engineering to remediate defects and harden cloud-native, containerized applications.

Lead AI security strategy and guardrails, design and review AI gateways and tooling, scale InfoSec review processes, reduce AI-driven security noise, drive remediation and investigations, and mentor security and platform engineers.

Lead product security across the SDLC: threat modeling, secure architecture, vulnerability management, security testing and remediation, CI/CD/DevSecOps controls, AI security integration, bug bounty triage, developer training, and cross-functional security consulting to scale secure-by-design practices.

As a Security Engineer, you will conduct security assessments, develop security tools, perform architecture reviews, and collaborate on advanced security research.

This role involves owning the security architecture for AI platforms on GCP, designing guardrails, and integrating security into CI/CD pipelines. Candidates should have extensive experience in cloud security, specifically with GCP services, Kubernetes security, and AI/ML security practices.

Lead assessment and mitigation of security risks in the virtualization stack. Build threat models, rubrics, and defenses; partner with kernel, virtualization, and provisioning teams to design and implement mitigations; mentor engineers, manage vulnerability backlog, and promote security best practices across product teams.

Design, implement, and maintain scalable cloud security controls for Vercel's platform. Harden infrastructure using infrastructure-as-code and policy enforcement, secure CI/CD pipelines, perform threat modeling and risk analysis, improve monitoring and incident response, and build platform-level security tooling in collaboration with platform and infrastructure teams.

Design, maintain, and extend abuse detection and prevention systems for GitLab's SaaS platform. Serve as a core maintainer of a Ruby on Rails monolith, build anomaly detection and agentic AI mitigations, automate abuse response, collaborate with peer engineering and security teams, and produce runbooks and operational documentation.

Assess and harden software supply chain security by performing technical assessments, designing and implementing security controls and monitoring for build pipelines, investigating systems for vulnerabilities, creating tooling to address gaps, and leading cross-team projects to improve CrowdStrike's product security posture.

Partner with engineering, compliance, and security teams to embed application security into the SDLC: triage static/SCA alerts, advise on OWASP Top 10 remediation, maintain developer playbooks and training, track security metrics and evidence for audits, and help shape AI governance and GenAI-safe workflows.

Own and evolve the application security program: embed secure SDLC practices, partner with engineering on design and code reviews, manage AppSec tooling (SAST/DAST/ASM/WAF/mobile), harden AWS deployments, integrate security into CI/CD, and lead vulnerability investigation and remediation efforts.