Security Assurance Engineer; Contractor

Our client, a Boston-based public entity, is seeking an experienced Security Assurance Engineer (Contractor) to provide fixed-term security delivery capacity for two active fiscal year 2027 capital Modernization projects involving bank application portfolios and consumer / contractor Interactions.

Reporting to the Chief Information Security Officer (CISO), the contractor will work with the project teams to build security requirements, risk analysis, security testing, vulnerability triage, remediation planning and implementation, control implementation, and release-readiness activities into the delivery schedule.

The role will provide project-scoped security assurance from design through deployment. The contractor will analyze and triage risks, develop and help implement remediation plans and technical controls, guide agency personnel who own and operate those controls, and verify closure and residual risk decisions. The engagement is dedicated project delivery capacity for the two named modernization efforts and is not a substitute for recurring security operations or unallocated staff augmentation.

This is a hybrid position with work both remote and onsite as needed, and it expected to last approximately 7+ months.

• Define and document project security requirements, control objectives, implementation details, and acceptance criteria for planned releases and production changes.
• Review application architecture, data flows, integrations, and control designs across applications, databases, Amazon Web Services (AWS), Salesforce-based applications, artificial intelligence (AI)-enabled services, identity, logging, infrastructure, and document handling.
• Perform project-specific risk analyses that evaluate threat scenarios, exploitability, exposure, data sensitivity, business and regulatory impact, existing controls, and release dependencies. Document inherent and residual risks with recommended treatment options.
• Implement approved project-scoped security controls and technical safeguards when assigned. Guide agency personnel on control ownership, configuration, operation, evidence collection, exception handling, and transition to ongoing management.

• Coordinate static application security testing (SAST), dynamic application security testing (DAST), penetration testing, and vulnerability scanning, including scope, schedules, tool configuration, participants, findings, and follow-up.
• Analyze and triage findings from Tenable Cloud, Veracode static and dynamic testing, Git Hub, testing providers, and other approved sources. Validate findings, identify false positives and duplicates, analyze root causes and affected components, determine severity and release priority, identify owners, and record the rationale in Jira or the applicable tracking system.
• Develop remediation plans with clear technical actions, owners, priorities, dependencies, target dates, validation steps, and any required compensating controls or risk decisions.
• Assess RAG pipelines and LLM-based solutions, identifying vulnerabilities – prompt injection, data leakage, retrieval poisoning, model behavior manipulation.
• Design & execute adversarial tests for model robustness, red‑team simulations, jailbreak attempts, evaluate guardrails
• Implement approved project-scoped remediations and controls directly when authorized or work hands-on with responsible agency personnel and vendors when access or separation-of-duties requirements assign change execution elsewhere. Verify closure through retesting and evidence review. Collaborate with engineering team as required.
• Use approved AI-assisted techniques and Git Hub…