AppSec and DevSecOps Lead

Ready to join a team that’s all in? At Imprivata, we deliver unified access and security management programs that eliminate friction, empowering healthcare and mission-critical organizations to work smarter, faster, and more securely.

We believe work can be more than a job or task—it’s a collective spirit; the type that emboldens creativity, embraces challenge, and fosters excitement. We are constantly raising the bar on what’s possible, owning the outcome of our triumphs and trials, staying nimble amidst change, and cultivating an environment where we win together. Here, your ideas matter, your differences are celebrated, and your work drives real results—for your career, your teammates, and our customers.

When you join Imprivata, you embark on a shared journey of ambition and growth. We’re committed to building an inclusive workplace where everyone feels valued and supported. If you’re looking for a place to match your passion with purpose—and where every day you can make an impact—you’ll find it here.

We are seeking an App Sec and Dev Sec Ops  Lead to join our team. This is a hybrid opportunity based out of our Waltham, MA office.

Imprivata is seeking an App Sec and Dev Sec Ops  Lead to operationalize Dev Sec Ops  across its product lines, engineering teams, and infrastructure. This role will embed security throughout the software and infrastructure lifecycle—from design and coding through testing, deployment, operations, and retirement.

The successful candidate will support cloud-native and traditional products deployed in customer-managed, on‑premises, virtualized, and hybrid environments. The role combines hands‑on engineering with organizational leadership to build secure automation, establish practical standards, and make secure delivery repeatable.

The position will support Imprivata’s identity, authentication, access, patient identity, remote support, analytics, and integration solutions across cloud services, endpoints, medical and shared‑use devices, APIs, virtual environments, legacy systems, and customer‑managed deployments.

• Execute Imprivata’s Dev Sec Ops  strategy across products, cloud, data centers, and traditional software, partnering with Engineering, Product, Platform, Quality, Dev Ops, Sec Ops, and GRC to drive adoption and clarify ownership.
• Establish security‑by‑design, secure‑by‑default, policy‑as‑code, reusable standards, reference architectures, and minimum security requirements.
• Embed SAST, DAST, SCA, secrets, container, IaC, API, and license scanning into CI/CD, with measurable, risk‑based security gates tailored to products and deployment models.
• Secure Git workflows, build systems, runners, identities, repositories, signing systems, credentials, release artifacts, SBOMs, provenance, and other software supply‑chain controls.
• Apply secure‑by‑default controls to cloud, networks, identity, platforms, containers, databases, APIs, serverless services, and service communications.
• Use infrastructure‑as‑code, policy‑as‑code, and automation to address drift, excessive privileges, exposed services, and insecure network paths, while partnering on secrets, encryption, segmentation, logging, monitoring, resilience, testing, and remediation.
• Address security for authentication, authorization, privileged access, sessions, tenant isolation, APIs, federation, mobile, endpoints, healthcare data, new services, acquisitions, and major releases.
• Secure agentic AI and MCP servers, clients, code, and workflows through threat modeling, least privilege, authentication, authorization, tool validation, secure APIs, prompt‑injection protection, data‑loss prevention, sandboxing, isolation, monitoring, and human approval.
• Operationalize findings from code,…