Security Assurance Engineer RFQ

Security Assurance Engineer – Contract,

Location:

Boston, MA, Work Model:
Hybrid, Job Type: Contract, Duration: 6–12 months, with possibility of extension,

Hours:

37.5 hours/week, Project Duration:
Through June 30, 2027, with possibility of extension

Our client, a Massachusetts-based public-sector organization, is seeking an experienced Security Assurance Engineer to support major application modernization initiatives. The Security Assurance Engineer will provide project-focused security assurance from design through deployment. This includes security requirements, risk analysis, security testing, vulnerability triage, remediation planning, security controls, and release-readiness activities. The role will work closely with project teams, application owners, architects, developers, vendors, testing teams, and security stakeholders.

• Define and document project security requirements, control objectives, implementation details, and acceptance criteria.
• Review application architecture, data flows, integrations, databases, AWS, Salesforce-based applications, AI-enabled services, identity, logging, infrastructure, and document handling.
• Perform project-specific security risk analysis covering threat scenarios, exploitability, exposure, data sensitivity, business and regulatory impact, existing controls, and release dependencies. Document inherent and residual risks and provide recommended treatment options.
• Implement approved project-scoped security controls and technical safeguards when assigned. Guide application and business teams on control ownership, configuration, operation, evidence collection, exceptions, and transition to ongoing management.
• Coordinate SAST, DAST, penetration testing, and vulnerability scanning. Analyze and triage findings from vulnerability scanners, application security testing tools, code repositories, testing providers, and other approved sources. Validate findings, identify false positives and duplicates, analyze root causes and affected components, determine severity and release priority, and identify owners.
• Track security findings and remediation activities using Jira or applicable tracking systems. Develop remediation plans with technical actions, owners, priorities, dependencies, target dates, validation steps, compensating controls, and risk decisions. Verify remediation through retesting and evidence review. Collaborate with engineering teams, application owners, vendors, and testing providers. Escalate material findings, blocked remediation, and risks that could affect project milestones or go-live readiness.
• Prepare security review results, testing evidence, remediation plans, control documentation, risk decisions, and release-readiness records. Verify that Critical and High findings are remediated, retested, addressed through approved compensating controls, or formally accepted before go-live. Present residual risks and recommendations to appropriate risk-acceptance stakeholders.
• Maintain accurate security documentation and evidence throughout the project lifecycle.

• The role will also support security assessment of AI-enabled solutions, including: RAG pipelines and LLM-based solutions, Prompt injection, Data leakage, Retrieval poisoning, Model behavior manipulation, Jailbreak attempts, AI guardrail evaluation, Adversarial and red-team testing.
• The engineer may also use approved AI-assisted capabilities for vulnerability testing, secure code review, test-case development, finding analysis, and remediation planning.

• 5+ years of professional experience in application security, cloud security, product security, security engineering, or a closely related field.
• Experience defining security…