Security Assurance Engineer

This opportunity is with a public-sector organization supporting economic development and regulatory modernization initiatives across Massachusetts. Based in Boston, this is a long-term contract engagement focused on application security, cloud security, vulnerability management, and security assurance for large modernization programs involving AWS, Salesforce, AI-enabled solutions, and public-facing digital services. The role follows a hybrid schedule, requiring onsite attendance in Boston, including a minimum of three days per week during the first 90 days and typically two to three days per week thereafter., * Define security requirements, control objectives, implementation criteria, and release-readiness standards

• Review application architectures, integrations, AWS environments, Salesforce platforms, AI services, databases, identity systems, and logging solutions
• Conduct security risk assessments and document mitigation strategies
• Coordinate SAST, DAST, penetration testing, and vulnerability scanning efforts
• Analyze and triage findings from Veracode, Tenable, GitHub, penetration tests, and other security assessment tools
• Develop remediation plans and partner with engineering teams to drive resolution
• Verify vulnerability closure through retesting and evidence validation
• Perform security reviews of AI-enabled applications, RAG pipelines, and LLM-based services
• Execute adversarial testing, red-team assessments, jailbreak testing, and guardrail evaluations
• Collaborate with security teams, project managers, developers, vendors, and managed service providers
• Prepare risk documentation, testing evidence, security reports, and production-readiness assessments
• Support modernization initiatives involving licensing systems, reporting platforms, citizen service portals, complaint management solutions, and AI-assisted workflows

• 5+ years of experience in application security, cloud security, product security, security engineering, or a related field
• Experience defining security requirements and reviewing application architectures, integrations, data flows, and technical controls
• Strong background coordinating and evaluating SAST, DAST, penetration testing, and vulnerability assessments
• Experience performing vulnerability triage, risk analysis, remediation planning, and validation of corrective actions
• Hands-on experience with AWS cloud environments
• Working knowledge of Salesforce-based applications
• Experience using Tenable, Veracode, GitHub, Jira, and related security tooling
• Knowledge of identity management, logging, infrastructure security, deployment controls, and data protection practices
• Experience documenting security findings, residual risk decisions, and production-readiness assessments
• Strong communication skills with both technical and non-technical stakeholders
• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or related field, or equivalent experience with a security certification such as CISSP

Desired Skills & Experience

• Experience securing public-facing applications and regulated environments
• Experience with cloud modernization and legacy application transformation initiatives
• Experience assessing AI solutions, Retrieval-Augmented Generation (RAG) architectures, large language models (LLMs), and AI voice technologies
• Knowledge of prompt injection, retrieval poisoning, data leakage, jailbreak testing, and AI red-team exercises
• Familiarity with NIST security frameworks
• Experience working with managed security service providers (MSSPs)
• Public-sector, government, financial services, or consumer protection experience
• Relevant certifications including CISSP, CCSP, CSSLP, or similar security credentials
• Experience using GitHub Copilot or approved AI-assisted security testing tools, * AWS Cloud Security
• Salesforce Security
• Veracode (SAST/DAST)
• Tenable Cloud
• GitHub & GitHub Copilot
• Jira
• AI Security (LLMs, RAG Architectures, Voice AI)
• Identity & Access Management
• Application Security Testing
• Vulnerability Management
• Risk Analysis & Security Assurance