I'm not based there but I'm pretty sure there Boston's big enough that you'd find good opportunities there. Maybe start there and consider a move later.
Sounds like you have a direction - do more in application security while holding on to a degree of flexibility and keeping in touch with platform / infrastructure skills. Flexibility tends to result from smaller companies, but autonomous teams in bigger companies might also get this.
What opportunities are there within your current company to look at application security? What skills would you need to develop to do those - this is likely programming / networking more than infrastructure. Can you push for exposure to those areas within the current company? If you are good then there will be many companies where you will get latitude in what you work on, so don't feel too scared.
Generally it's a good idea to push your skillset as far as you can go in the current company, ideally get a couple of successful applications in place based on your good performance and skillset. You can then negotiate for what you want (pay, learning opportunities, responsibility) from a position of strength. Nothing to stop you negotiating straight away but if you get push back then you need to think about what your plan B is.
Also make a list of companies you like the sound of in Boston and try to find out more about them. Even if they're not hiring see if you can find people who work for them and arrange meetings. You should get a clearer idea soon enough of what's out there and whether they'd really be the right kind of place for you.