Senior Application Security Engineer - Acton, Mass. or San Diego, CA (Hybrid)

As a Senior Application Security Engineer within the Product Security team, you will play a critical role in securing software products throughout their lifecycle. This position requires deep technical expertise, strategic thinking, and leadership capabilities. You will act as a key contributor to the secure development of medical technologies.

Key Responsibilities

• Secure Product Development Framework: Drive the implementation and continuous improvement of secure software development practices across product teams, ensuring alignment with regulatory and industry standards.
• Advanced Security Testing: Lead SAST, DAST, SCA, and API security testing within CI/CD pipelines. Analyze results, manage risk, and guide remediation efforts.
• Mentorship & Delegation: Serve as a technical and strategic resource for junior engineers. Step into a leadership role in the absence of the Sr. Manager, supporting team operations and decision-making.
• Security Awareness & Culture: Support the development and rollout of security awareness initiatives to embed a security-first mindset across engineering teams.
• Vulnerability Management: Participate in vulnerability disclosure and bug bounty programs, ensuring timely triage, communication, and resolution of findings.
• Metrics & Automation: Develop and maintain dashboards and automation tools to track and report on application security posture and trends.
• Threat Modeling & Code Review: Conduct threat modeling, code reviews, and vulnerability assessments, ensuring coverage of OWASP Top 10 and CWE Top 25.
• Cross-Functional Collaboration: Partner with teams in Quality, Regulatory, Legal, Privacy, and Engineering to ensure security is integrated from design through deployment.
• Regulatory Support: Contribute to cybersecurity documentation for regulatory submissions (e.g., FDA pre/post market guidance, 510(k)), ensuring compliance with SPDF and other frameworks.
• Innovation & Research: Stay current on emerging threats, tools, and technologies, and assess their relevance to product security.

Qualifications

• Education: Bachelor's degree in computer science, Software Engineering, Cybersecurity, or equivalent experience.
• Experience: 5+ years in application security or related cybersecurity roles, preferably in regulated industries such as medical devices or healthcare.
• Technical Proficiency: Hands-on experience with tools such as Check Marx, Snyk, ZAP, GitHub, Bitbucket, Dependency Track, and SBOM generation. Familiarity with CI/CD pipelines and secure coding practices.
• Programming Knowledge: Proficiency in JavaScript, Python, Java, Swift and Kotlin, or similar languages.
• Security Expertise: Strong understanding of threat modeling, exploit techniques, and security frameworks (e.g., OWASP, MITRE ATT&CK).
• Leadership & Communication: Ability to explain complex security concepts to diverse audiences, build consensus, and influence decision-making across teams.

NOTE: This position is eligible for hybrid working arrangements and requires on-site work from an Insulet office at least three (3) days per week. #LI-Hybrid 

Additional Information:

The US base salary range for this full-time position is $105,000.00 - $157,500.00. Our salary ranges are determined by role, level, and location. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position in the primary work location in the US. Within the range, individual pay is determined by work location and additional factors, including job-related skills, experience, and relevant education or training. Your Talent Acquisition Specialist can share more about the specific salary range for your preferred location during the hiring process. Please note that the compensation details listed in US role postings reflect the base salary only, and do not include bonus, equity, or benefits.

Insulet Corporation (NASDAQ: PODD), head