Security Assurance Engineer

The Executive Office of Economic Development (EOED) is seeking an experiencedSecurity Assurance Engineer (Contractor) to provide fixed-term security delivery capacity for two active fiscal year 2027 capital projects: the Division of Banks Application Portfolio Modernization and Consumer & Contractor Interaction Modernization. Reporting to the EOED Chief Information Security Officer (CISO), the contractor will work with the project teams to build security requirements, risk analysis, security testing, vulnerability triage, remediation planning and implementation, control implementation, and release-readiness activities into the delivery schedule.

The role will provide project-scoped security assurance from design through deployment. The contractor will analyze and triage risks, develop and help implement remediation plans and technical controls, guide agency personnel who own and operate those controls, and verify closure and residual-risk decisions. The engagement is dedicated project delivery capacity for the two named modernization efforts and is not a substitute for recurring security operations or unallocated staff augmentation.

Position Details

•Job Title: Security Assurance Engineer (Contractor - Division of Banks and Consumer Modernization)

•Engagement Term: October 14, 2026 through June 30, 2027

•Estimated Level of Effort: Approximately 1,254 hours over the engagement

•Work Schedule: Project-based allocation; monthly hours will vary according to approved milestones, release windows, testing schedules, and unresolved findings

•Work Model: Hybrid and Massachusetts-based, with on-site attendance as project needs require

•Reporting To: EOED Chief Information Security Officer (CISO)

•Primary Assignments: Division of Banks Application Portfolio Modernization and Consumer & Contractor Interaction Modernization

•Position Type: Fixed-term contractor / consulting services

Key Responsibilities

Security Requirements, Risk Analysis, and Control Implementation

• Define and document project security requirements, control objectives, implementation details, and acceptance criteria for planned releases and production changes.

• Review application architecture, data flows, integrations, and control designs across applications, databases, Amazon Web Services (AWS), Salesforce-based applications, artificial intelligence (AI)-enabled services, identity, logging, infrastructure, and document handling.

• Perform project-specific risk analyses that evaluate threat scenarios, exploitability, exposure, data sensitivity, business and regulatory impact, existing controls, and release dependencies. Document inherent and residual risks with recommended treatment options.

• Implement approved project-scoped security controls and technical safeguards when assigned. Guide agency personnel on control ownership, configuration, operation, evidence collection, exception handling, and transition to ongoing management.

Vulnerability Testing, Triage, and Remediation

• Coordinate static application security testing (SAST), dynamic application security testing (DAST), penetration testing, and vulnerability scanning, including scope, schedules, tool configuration, participants, findings, and follow-up.

• Analyze and triage findings from Tenable Cloud, Veracode static and dynamic testing, GitHub, testing providers, and other approved sources. Validate findings, identify false positives and duplicates, analyze root causes and affected components, determine severity and release priority, identify owners, and record the rationale in Jira or the applicable tracking system.

• Develop remediation plans with clear technical actions, owners, priorities, dependencies, target dates, validation steps, and any required compensating controls or risk decisions.

• Assess RAG pipelines and LLM-based solutions, identifying vulnerabilities - prompt injection, data leakage, retrieval poisoning, model behavior manipulation.
• Design & execute adversarial tests for model robustness, red‐team simulations, jailbreak attempts, evaluate guardrails

• Implement approved project-scoped remediations and controls directly when authorized, or work hands-on with responsible agency personnel and vendors when access or separation-of-duties requirements assign change execution elsewhere. Verify closure through retesting and evidence review. Collaborate with engineering team as required.

• Use approved AI-assisted techniques and GitHub Copilot, where appropriate, to support vulnerability testing, secure code review, test-case development, or remediation analysis. Validate results and follow Commonwealth and EOED data-handling requirements.

• Escalate material findings, blocked remediation, and decisions that could affect project milestones or go-live readiness to project leadership and the EOED CISO.

Shared Security Services Coordination

• Work within EOED's managed security service provider (MSSP) relationship with the Executive Office of Technology Services and Security (EOTSS) to coordinate service intake, testing scope, access, scheduling, escalation, evidence exchange, remediation, retesting, and closure.

• Coordinate with EOTSS security and technology teams as required, apply applicable EOTSS policies and standards, and clarify responsibilities and handoffs among EOED, EOTSS, project teams, and vendors.

• Translate EOTSS and MSSP findings into project-specific priorities and action plans, track dependencies, and escalate service constraints that could affect a release or remediation deadline.

Division of Banks Application Portfolio Modernization Support

• Support security review and release readiness for the Nationwide Multistate Licensing System (NMLS), Online Annual Reporting System (OARS), and Regulatory Management System (RMS) modernization work, including application, platform, identity, data, logging, and deployment controls.

• Coordinate testing and vulnerability remediation for project changes and validate the evidence required for production acceptance.

Consumer & Contractor Interaction Modernization Support

• Support security design and testing for the Massachusetts Contractor Hub, Lemon Law portal, Home Improvement Contractor (HIC) Hotline AI Voice Agent, and Department of Telecommunications and Cable (DTC) consumer complaint workflows.

• Review Salesforce, AWS, AI-service, integration, identity, and document-upload risks and verify go-live readiness for public-facing workflows.

Release Readiness and Risk Documentation

• Prepare documented risk analyses, triage decisions, security review results, testing evidence, control implementation records, remediation plans and status, and release-readiness records for each project.

• Verify that project-scoped Critical and High findings are remediated, retested, or formally accepted before go-live.

• Present residual risks and recommended decisions to the appropriate EOED risk-acceptance authority, and coordinate deliverable acceptance with the EOED CISO or designated project owner.

• The contractor does not independently accept residual risk or authorize production deployment.

• Confirm that agency control owners understand continuing responsibilities and receive the procedures, evidence expectations, and transition information needed to manage implemented controls.

Project Controls and Reporting

• Associate each supported work item with a project code, defined deliverable, acceptance criteria, and production or asset-in-service cutoff.

• Provide monthly reporting by project code showing hours, completed security deliverables, testing completed, findings addressed, open findings and risks, upcoming decisions, and release-readiness evidence.

• Coordinate with EOED and agency project managers, product owners, architects, developers, testing teams, application owners, agency control owners, vendors, and EOTSS security and shared-service personnel.

• Provide limited support to closely related capital security work only when it does not displace commitments to the two primary projects.

Role Boundaries

• The role may implement or support remediation and controls tied to approved project deliverables. It does not own routine enterprise scanning, generic vulnerability backlog work, broad policy maintenance, or unrelated incident response.

• The role does not provide recurring access reviews, standing audit support, general security awareness training, or other ongoing operational duties.

• Post-go-live monitoring and maintenance are outside scope unless separately approved as a defined project transition deliverable.

Required Qualifications

• Five or more years of professional experience in application security, cloud security, product security, security engineering, or a closely related field.

• Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field. A Certified Information Systems Security Professional (CISSP) credential, or a comparable security certification, together with relevant professional experience will be considered equivalent to the bachelor's degree requirement.

• Demonstrated experience defining security requirements and reviewing application architectures, data flows, integrations, and technical controls.

• Experience coordinating SAST, DAST, and penetration testing and validating remediation or retest evidence.

• Demonstrated experience performing risk analysis and vulnerability triage, developing remediation plans, implementing or supporting technical remediation, and tracking findings to closure.

• Experience implementing security controls and guiding agency or business personnel on control ownership, operation, evidence, exceptions, and ongoing management.

• Working familiarity with Jira, Salesforce-based applications, Tenable Cloud, Veracode static and dynamic testing, GitHub, and GitHub Copilot or comparable approved tools.

• Experience using AI-assisted capabilities responsibly for vulnerability testing, source-code or configuration review, finding analysis, or remediation planning.

• Working knowledge of identity, data protection, logging, deployment, cloud, and infrastructure controls for complex applications.

• Experience documenting security findings, residual risk, control decisions, and production-readiness recommendations.

• Experience coordinating security work across project teams, vendors, shared-service organizations, and managed security service providers.

• Ability to manage concurrent work against milestones, release schedules, acceptance criteria, and project reporting requirements.

• Excellent written and verbal communication skills, including the ability to explain technical risks to technical and non-technical stakeholders.

• Ability to work independently, maintain accurate evidence, and escalate risks or blockers promptly.

Preferred Qualifications

• Experience securing AWS, Salesforce, public-facing digital services, or regulated application environments.

• Experience supporting legacy-platform modernization, cloud re-platforming, or complex application integrations.

• Experience working with AI solutions and infrastructure - (RAG pipelines, LLM models, Voice Models)

• Familiarity with security considerations for AI-enabled services, document uploads, constituent data, and regulated workflows.

• Hands-on experience using Jira, Tenable Cloud, Veracode, GitHub, GitHub Copilot, and Salesforce-based applications in an enterprise or public-sector delivery environment.

• Knowledge of National Institute of Standards and Technology (NIST) security frameworks and Commonwealth of Massachusetts or EOTSS security policies and standards.

• Prior experience in state government, the public sector, financial services, consumer protection, or another regulated environment.

• Relevant certifications such as CISSP, Certified Cloud Security Professional (CCSP), Certified Secure Software Lifecycle Professional (CSSLP), or a comparable application, cloud, or security engineering credential.

• Experience coordinating work across internal teams, systems integrators, vendors, and independent testing providers.

Performance Expectations and Deliverables

• Security input is provided during design and build, not only at the end of delivery.

• Each project has documented security requirements, risk analyses, triage decisions, review results, testing records, control evidence, and clear risk decisions before production.

• Remediation plans identify accountable owners, priorities, dependencies, target dates, and validation steps, and approved remediations are implemented and tracked to closure.

• Project-scoped Critical and High findings are remediated and retested, addressed through approved compensating controls, or formally accepted before go-live.

• Implemented controls are documented, supported by evidence, and transitioned to agency personnel with clear operating and management guidance.

• Release-readiness evidence is complete, accurate, traceable to acceptance criteria, and available for management review.

• EOTSS service requests, findings, escalations, dependencies, and handoffs are tracked through the applicable EOED and MSSP workflows.

• AI-assisted testing and analysis are independently validated and performed only through EOED-approved tools and processes.

• Monthly reporting clearly shows hours, completed deliverables, testing performed, findings addressed, open risks, and upcoming decisions by project code.

• Work remains focused on the two primary projects unless the CISO approves a limited, non-displacing adjacent capital assignment.

EEO:- Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of – Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans