Director, Application Security
Who are we?
A strategic and trusted insurance partner, Berkshire Hathaway Specialty Insurance (BHSI), provides a broad range of commercial property, casualty and specialty insurance coverages and outstanding service to customers and brokers around the world. Part of Berkshire Hathaway’s insurance operations, we bring our solutions to market with our stellar brand name, top-rated balance sheet, and the expertise of our global team of professionals, who exude excellent capabilities and strong character.
We are a values-based organization where respect, integrity, excellence, collaboration, and passion define who we are and how we do business. We value diversity of backgrounds, experience, and perspectives and strive to foster an inclusive environment that enables all our team members to bring their best selves to work. We are one team committed to building a culture where every teammate has the opportunity to contribute and be recognized. Want to be part of the team building the finest property, casualty, and specialty lines insurance company in the world?
Learn more about our unique culture and history.
Job Opportunity:
Berkshire Hathaway Specialty Insurance (BHSI) is looking for a strong leader in Application Security to join our Boston-based team as a Director, Application Security. The Director, Application Security leads BHSI’s Application Security Engineering team and shapes the security strategy for mission-critical applications, APIs, and cloud platforms across secure code review, threat modeling, DevSecOps, cloud security, and penetration testing. Accountable for the team’s people, strategy, standards, tooling, and outcomes; serves as the go-to security expert for development, product, and business teams; establishes governance, controls, and compliance across cloud infrastructure; and reports application and risk posture to security leadership and executives.
The Director, Application Security reports to the Assistant Vice President of Security Operations. This role works closely with development, DevOps, cloud platform, and business teams in Boston; available for escalations involving critical vulnerabilities or security incidents. Success in this role is measured by vulnerability escape rate and mean time to remediate; secure SDLC, threat-modeling, and testing coverage; cloud security posture and misconfiguration trends; cloud incident response outcomes; adoption of AppSec and cloud standards and paved roads; audit and regulatory outcomes; roadmap and budget delivery; team engagement, retention, and Security Champions program health.
Duties & Responsibilities:
- Leadership: Lead, mentor, and develop the Application Security team, including application and cloud security engineers and analysts: hiring, coaching, performance management, career paths, and capacity planning. Lead the Security Champions program.
- Strategy: Own the application and cloud security strategy, standards, and policies across IaaS, PaaS, and SaaS environments. Align secure coding principles with development projects and create actionable roadmaps.
- Secure Code Review & Testing Tools: Own the enterprise secure SDLC program and AppSec tooling strategy (SAST, DAST, IAST, SCA, secrets scanning). Ensure vulnerabilities are remediated before release.
- Threat Modeling & Secure Design: Serve as the go-to security SME for development, product, and business teams. Champion secure design and testing using the OWASP Top 10 and OWASP API Security Top 10. Set threat-modeling expectations for new and changed applications. Guide migration and modernization efforts so implementations are secure by design.
- DevSecOps & Pipeline Security: Act as a thought leader in DevSecOps: embed security controls and testing into CI/CD pipelines, set enterprise pipeline guardrail and paved-road strategy, and guide platform and pipeline upgrades. Oversee IaC scanning, container security, and software supply-chain security. Collaborate with engineering to remediate findings and architect secure workloads.
- Cloud Security: Be accountable for application and cloud security posture across Azure, AWS, and other cloud platforms. Define cloud architecture security principles aligned with Zero Trust and set reference architectures with Architecture and Infrastructure. Lead cloud risk assessments, gap analysis, and initiative planning. Support cloud IAM frameworks (least privilege, conditional access, workload identities). Drive adoption of encryption, secrets management, and key management (BYOK/CMK). Ensure data classification and DLP controls are effective across cloud environments.
- Cloud Security Operations & Threat Management: Oversee the configuration, monitoring, and continuous improvement of CSPM, CWPP/CNAPP, SIEM/SOAR integrations for cloud telemetry, and identity threat detection (ITDR). Ensure continuous monitoring for misconfigurations, vulnerabilities, and anomalies. Direct incident response for cloud-related security events in collaboration with Security Operations.
- AI Usage: Regularly use AI to improve code review, testing, cloud configuration review, and remediation guidance. Provide input on AI tools and on security requirements for AI-enabled applications and cloud services, in partnership with the AI security leader.
- Application Penetration Testing: Own the application testing program, including internal testing and external penetration testing firms. Set risk-based testing coverage and frequency. Ensure critical findings are risk-rated, tracked, and remediated within SLA. Approve and escalate risk exceptions.
- Collaboration, Risk & Leadership: Evolve security frameworks, policies, and standards to meet emerging threats and compliance requirements (e.g., NYDFS 23 NYCRR 500). Ensure cloud environments meet regulatory and compliance requirements. Own application and cloud security audits and evidence collection. Mature asset inventories, risk registers, and control documentation. Support regulatory examinations. Provide regular reporting to security leadership and executives. Partner across Technology, Infrastructure, DevOps, and Architecture.
Qualifications, Skills and Experience:
- 10+ years of proven success in application security, with deep experience in Azure and AWS, including 5+ years leading security or engineering teams
- ISC2 CISSP, ISC2 CSSLP, or ISACA CISM — or equivalent experience: 10+ years in application security, including leading an AppSec or DevSecOps program with direct reports, owning budget and tooling, and reporting risk to senior leadership
- Expert application security leadership across secure code review, threat modeling, DevSecOps, cloud security, and penetration testing
- Secure Code Review & Testing Tools: Expertise in secure SDLC frameworks and modern application security toolsets (SAST, DAST, IAST, SCA)
- Threat Modeling & Secure Design: Deep knowledge of secure design, the OWASP Top 10, and the OWASP API Security Top 10
- DevSecOps & Pipeline Security: Experience leading DevSecOps programs, pipeline guardrails, and paved-road standards; knowledge of Infrastructure-as-Code (Terraform, CloudFormation, Bicep) and container security
- Cloud Security: Deep, hands-on experience with Azure and AWS security services (GCP a plus); strong knowledge of cloud IAM and identity governance, network security (VPCs/VNets, firewalls, segmentation), and cloud-native monitoring, threat detection, and logging
- Cloud Security Tooling: Experience with CSPM, CWPP/CNAPP, SIEM, SOAR, and vulnerability management tools
- AI Usage: Experience using AI tools to improve application and cloud security outcomes
- Compliance: Knowledge of compliance frameworks and cloud shared responsibility models
- Leadership: A true security mindset, balancing tactical fixes with strategic vision; exceptional communication skills to translate complex technical issues into clear business insights
- Preferred: CSA CCSK; OffSec OSCP or OSWE; ISC2 CCSP; GIAC GSTRT or GSLC; Microsoft SC-100 (Cybersecurity Architect)
- Preferred: Experience in insurance or financial services
BHSI Offers:
- A competitive package and exciting growth opportunities for career-oriented teammates
- A dynamic, action-oriented, and thoughtful environment centered on always doing the right thing for our customers, teammates and our other stakeholders
- A purposely non-bureaucratic organization that embraces simplicity over complexity and emphasizes individual excellence in a team framework
- Benefits that support your life and well-being, which include:
- Comprehensive Health, Dental and Vision benefits
- Disability Insurance (both short-term and long-term)
- Life Insurance (for you and your family)
- Accidental Death & Dismemberment Insurance (for you and your family)
- Flexible Spending Accounts
- Health Reimbursement Account
- Employee Assistance Program
- Retirement Savings 401(k) Plan with Company Match
- Generous holiday and Paid Time Off
- Tuition Reimbursement
- Paid Parental Leave
The base salary range for this position in Boston is $180,000 to $210,000, along with annual bonus eligibility; a candidate’s salary is determined by their relevant skills and experience. We value our teammates – both their capabilities and character – as demonstrated by our amazing culture.
NOTE: Compensation will be commensurate with experience. This job description is not intended to be all-inclusive. Team Member may perform other related duties as negotiated to meet the ongoing needs of the organization.
You'll be redirected to
the company's application page