Senior Application Security Engineer

Who are we?

A strategic and trusted insurance partner, Berkshire Hathaway Specialty Insurance (BHSI), provides a broad range of commercial property, casualty and specialty insurance coverages and outstanding service to customers and brokers around the world. Part of Berkshire Hathaway’s insurance operations, we bring our solutions to market with our stellar brand name, top-rated balance sheet, and the expertise of our global team of professionals, who exude excellent capabilities and strong character.

We are a values-based organization where respect, integrity, excellence, collaboration, and passion define who we are and how we do business. We value diversity of backgrounds, experience, and perspectives and strive to foster an inclusive environment that enables all our team members to bring their best selves to work. We are one team committed to building a culture where every teammate has the opportunity to contribute and be recognized. Want to be part of the team building the finest property, casualty, and specialty lines insurance company in the world?

Learn more about our unique culture and history.

Job Opportunity:

Berkshire Hathaway Specialty Insurance (BHSI) is looking for a Senior Application Security Engineer to join our Boston-based Application Security team. The Senior Application Security Engineer leads complex reviews, threat models, and penetration tests, and designs secure platform, pipeline, and cloud capabilities that scale across teams. Mentors engineers and testers, supports the Security Champions program, and improves the AppSec program.

The Senior Application Security Engineer reports to the Director, Application Security. This role works embedded with Agile development, DevOps, and cloud platform teams; occasional after-hours support for critical vulnerabilities, testing windows, or security incidents. Success in this role is measured by vulnerability escape rate to production; supply-chain and cloud guardrail coverage; outcomes of complex and external tests; cloud posture score; Security Champions program engagement; mentee development.

Duties & Responsibilities:

• DAST Program & Validation: Own the end-to-end DAST process. Define scan scope, configure authenticated scans for web applications and APIs, tune scan policies, and schedule scans with development and release teams. Manually validate findings by reproducing issues, removing false positives, confirming exploitability, and assigning risk-based severity.
• SAST Reviews: Run, tune and review SAST scans across the application portfolio. Triage results, confirm real vulnerabilities, suppress false positives with documented justification, and refine rules to reduce noise over time.
• SCA & Software Supply Chain: Run SCA reviews to find vulnerable, outdated and unmaintained open-source dependencies. Assess reachability and real-world risk, and review license compliance. Secure the software supply chain through SBOM, artifact signing and dependency provenance.

• Collaboration, Risk & Leadership: Partner with Detection Engineering on purple-team exercises and cloud detections. Mentor engineers and testers, support the Security Champions program, and lead pipeline and cloud security reviews. Leverage AI to improve application and cloud security outcomes and developer experience.

Qualifications, Skills and Experience:

• 5–8 years, including 3+ years in application or cloud security with hands-on SAST, DAST and SCA, secure code review, pipeline security and cloud security experience.
• ISC2 CSSLP, GIAC GWEB, GIAC GWAPT, GIAC GCSA, AWS Certified Security – Specialty, or Microsoft SC-500, or equivalent experience: 5+ years, including owning security for a major product, a CI/CD platform or a production cloud environment, or leading an application security testing program.
• DAST: Proven experience setting up, running and validating DAST scans for web applications and APIs, including authenticated scanning, policy tuning, and manual confirmation of findings.
• SAST & SCA: Experience reviewing SAST and SCA results, separating true from false positives, assessing dependency risk and reachability, and prioritizing by exploitability and business impact. Strong understanding of software supply chain security (SBOM, artifact signing, dependency provenance).
• Secure Code Review: Strong code review skills in .NET (C#, ASP.NET Core, Web API), with expertise in authentication, authorization, API security (OAuth/OIDC), and cloud-native application risks.
• Threat Modeling & Secure Design: Experience leading threat models and design reviews for complex, cross-platform and cloud systems.
• DevSecOps & Pipeline Security: Experience managing and tuning security testing tools in CI/CD pipelines (Datadog experience a plus), including quality gates and noise reduction.
• Cloud Security: Strong understanding of landing zones, account/subscription structure, and organization-wide guardrails (SCPs, Azure Policy), plus automated detection and remediation of cloud risks.
• Leadership: Demonstrated experience leading complex reviews, mentoring engineers, and partnering with development and security operations teams.

• Preferred: OffSec OSWE; Burp Suite Certified Practitioner; GIAC GPCS; Certified Kubernetes Security Specialist (CKS).

BHSI Offers:

The base salary range for this position in Boston is $150,000 to $175,000, along with annual bonus eligibility; a candidate’s salary is determined by their relevant skills and experience. We value our teammates – both their capabilities and character – as demonstrated by our amazing culture.

NOTE: Compensation will be commensurate with experience. This job description is not intended to be all-inclusive. Team Member may perform other related duties as negotiated to meet the ongoing needs of the organization.