Information Security Engineer III, Application Security Lead

Mass General Brigham (Enterprise Services); Somerville (MA); Hybrid; USD 90,000 - 150,000; Full time

Job summary

An established industry player is seeking a skilled Information Security Engineer III to lead application and cloud security initiatives. This role involves designing robust security programs, mentoring junior engineers, and ensuring secure software development practices. The ideal candidate will possess deep technical knowledge in application security, cloud environments, and secure coding methodologies. This position offers a unique opportunity to influence security strategies and drive continuous improvement within a collaborative team environment. Join a forward-thinking organization committed to innovation and excellence in cybersecurity.

Qualifications

• 5+ years in application security or cloud security roles.
• Expertise in secure coding and application security testing tools.

Responsibilities

• Lead design and implementation of application and cloud security programs.
• Conduct security assessments and oversee vulnerability management.

Skills

Secure Software Development Methodologies

OWASP Top 10

Application Security Testing Tools (SAST, DAST, IAST)

Cloud Security (AWS, Azure, GCP)

Microservices and APIs Security

Leadership and Project Management

Education

Bachelor's degree in Information Security or Computer Science

Advanced degrees or equivalent professional experience

Tools

Cloud Security Posture Management Tools

Static and Dynamic Application Security Testing Tools

M365 Office Suite

Job description

Summary
The Mass General Brigham (MGB) Information Security Engineer III - Application and Cloud Security Lead provides leadership and expertise within the cybersecurity team, specifically overseeing security practices related to application development and cloud infrastructure. This role is responsible for ensuring robust and secure software development lifecycles, implementing advanced security strategies in cloud environments, and driving continuous improvement in both application security and cloud security posture. The Engineer will lead complex security projects, coordinate cross-team collaboration, and mentor junior and mid-level engineers to foster their professional growth. The ideal candidate is a deeply technical minded security professional focused on secure coding practices or development engineering with experience designing and executing strategic / programmatic roadmaps.
The Information Security Engineer III may represent the organization in industry forums or regulatory discussions. Additionally, this role actively engages with external partners, vendors, and stakeholders to establish collaborative security strategies and ensure alignment with industry trends and best-in-class security practices.
They should have prior experience building application and/or cloud security programs, and experience in multiple of the following areas:
*DevSecOps
*Strategic program build and design
*Secure Code Development
*Application Security Testing Tools
*CI/CD Pipeline Hardening
*Application and Code Vulnerability Analysis
*Cloud security expertise
Duties include
*Collaboratively design the application and cloud security program to meet the needs of Mass General Brigham. Lead engineers in the execution of the strategic roadmap.
*Leads the design, development, testing, and implementation of advanced security controls for application development and cloud environments based on published information security policies and business requirements
*Establishes and maintains a secure software development lifecycle (SSDLC), incorporating security checkpoints, threat modeling, secure coding standards, and rigorous testing practices.
*Drives the implementation and ongoing management of Cloud Security Posture Management (CSPM) tools and strategies, ensuring continuous monitoring and proactive remediation of cloud security issues.
*Implement and maintain code analysis tools (e.g., SAST, DAST, IAST, SCA, etc.) to identify security vulnerabilities in code before deployment. Collaborate with development teams to integrate these tools into workflows and provide actionable insights to remediate identified issues, fostering a proactive approach to secure coding practices.
*Serves as a technical leader within the cybersecurity team, providing guidance, mentorship, and professional development opportunities for junior and mid-level security engineers.
*Collaborates closely with development, operations, and DevOps teams to embed security seamlessly into software development and deployment processes, fostering a DevSecOps culture.
*Conducts and oversees application and cloud security assessments, including penetration testing, code reviews, configuration audits, and vulnerability management efforts.
*Innovates by researching, evaluating, and proposing new security technologies and methods specifically designed to improve the organization's application and cloud security maturity.
*Ensures high-quality, maintainable, and scalable security solutions through comprehensive architecture reviews, security assessments, and alignment with best practices.
*Responds promptly and effectively to complex security incidents involving applications and cloud resources, providing expert guidance and leading remediation efforts.
*Engages proactively with vendors, industry partners, and stakeholders to leverage external expertise, technologies, and best practices.
*Aligns all actions and decisions with organizational values, including Patients First, Affordability, Accountability & Service Commitment, Decisiveness, Innovation & Thoughtful Risk; and demonstrates commitment to Diversity & Inclusion, Integrity & Respect, Learning & Continuous Improvement, Personal Growth, and Teamwork & Collaboration.
*Performs other duties and responsibilities as assigned.

• Bachelor's degree in Information Security, Computer Science, or related field; advanced degrees or equivalent professional experience preferred.
• Minimum of 5+ years of progressive experience in application security, cloud security, or related cybersecurity roles.
• Relevant industry certifications preferred (CISSP, CCSP, CSSLP, AWS/Azure Security Specialty, GIAC certifications).

Skills for Success

• Expert-level knowledge and practical experience in secure software development methodologies, OWASP Top 10, and application security testing tools (SAST, DAST, IAST).
• A comprehensive understanding of secure coding principles, with the ability to guide development teams in adhering to these best practices. Hands-on experience with static and dynamic application security testing tools is preferred.
• Proven expertise in securing major cloud platforms (AWS, Azure, GCP), including experience with Cloud Security Posture Management tools, cloud-native security services, and infrastructure-as-code security.
• Deep understanding of modern software architectures, microservices, APIs, and container security best practices (e.g., Docker, Kubernetes).
• Ability to think strategically, creatively, and innovatively to design and implement robust security controls.
• Demonstrated leadership skills with strong project management capabilities, able to effectively communicate complex technical security issues clearly to technical and non-technical stakeholders.
• Proven track record of delivering and managing successful security projects and continuous improvement initiatives.
• Strong ability to apply documented processes, playbooks, and frameworks (e.g., OWASP, NIST CSF, etc.) to effectively address and resolve a wide variety of application security challenges.
• Knowledge of established security frameworks, including NIST Cybersecurity Framework (CSF), NIST 800-53 with a focus on their application in securing software and application environments.
• Preferred certifications include: Offensive Security Certified Professional (OSCP), Offensive Security Certified Expert (OSCE), GIAC Penetration Tester Certification (GPEN), GIAC Experienced Penetration Tester (GX-PT), GIAC Certified Red Team Professional (GRTP), GIAC Security Operations Certified (GSOC), GIAC Security Expert (GSE), etc.
• Must know how to use common M365 Office Suite of products.

• M-F Eastern Business Hours required
• Hybrid onsite Flexible working model required weekly includes onsite in office (number of days weekly can vary, must be flexible for business needs)
• 1-3 onsite days per week
• Remote working days require stable, secure, quiet, compliant working station

Mass General Brigham Incorporated is an Equal Opportunity Employer. By embracing diverse skills, perspectives and ideas, we choose to lead. All qualified applicants will receive consideration for employment without regard to race, color, religious creed, national origin, sex, age, gender identity, disability, sexual orientation, military service, genetic information, and/or other status protected under law. We will ensure that all individuals with a disability are provided a reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment.