Security Assurance Engineer

An experienced Security Assurance Engineer is needed for an immediate, fixed-term engagement supporting two major application modernization initiatives through June 2027. This project-focused opportunity is suited to a security professional who can integrate security requirements, risk assessments, vulnerability testing, remediation, and release-readiness activities throughout the software delivery lifecycle. Candidates must demonstrate at least five years of relevant experience, strong application and cloud security knowledge, and the ability to deliver documented security outcomes against defined project milestones.

• Professional
  
  Experience:
  
  Five or more years in application security, cloud security, product security, security engineering, or a closely related discipline.

• Education or Certification: A bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field. A CISSP or comparable security certification, combined with relevant experience, may satisfy the education requirement.

• Security Engineering: Demonstrated ability to define security requirements, review application architectures and data flows, assess integrations, and evaluate technical controls.

• Security Testing: Experience coordinating static application security testing (SAST), dynamic application security testing (DAST), penetration testing, and vulnerability scanning, including remediation validation.

• Risk and Remediation: Proven capability in risk analysis, vulnerability triage, severity prioritization, remediation planning, implementation support, and tracking findings through closure.

• Technical Tools: Working familiarity with Jira, Salesforce-based applications, Tenable Cloud, Veracode, Git Hub, and Git Hub Copilot or comparable approved technologies.

• Cloud and Application Controls: Knowledge of identity management, data protection, logging, deployment security, cloud infrastructure, and secure application integrations.

• Communication and Delivery: Strong written and verbal communication skills, accurate evidence management, independent execution, and the ability to coordinate multiple deliverables while escalating risks promptly.

The engagement requires hands-on security assurance across two application modernization programs, covering design, development, testing, remediation, and production readiness. The successful contractor will translate security findings into actionable technical plans, help implement approved controls, and collaborate with engineering teams, application owners, project managers, external vendors, and shared security service providers. Success will be measured through traceable security evidence, timely remediation, documented risk decisions, effective control handoffs, and clear reporting against project commitments.

• Define Security Requirements: Establish project-specific security objectives, control requirements, implementation guidance, and acceptance criteria for application changes and planned releases.

• Assess Technical Risk: Examine architectures, data flows, integrations, cloud services, identity controls, logging, and document-handling processes to identify threats, exposures, and potential business impacts.

• Coordinate Security Testing: Plan and manage application security assessments, penetration tests, vulnerability scans, testing schedules, and follow-up activities.

• Triage Vulnerabilities: Validate reported weaknesses, eliminate duplicates and false positives, investigate root causes, assign severity, identify responsible owners, and document prioritization decisions.

• Develop and Execute Remediation Plans: Define corrective actions, dependencies, deadlines, validation requirements, and compensating controls; implement approved changes when authorized or coordinate execution with designated teams.

• Evaluate AI Security: Assess retrieval-augmented generation (RAG) pipelines, large language model (LLM) applications, and voice-enabled services for prompt injection, data leakage, retrieval poisoning, jailbreaks, and model manipulation.

W2 employees of Overture Partners who work 30 or more hours per week are eligible for the following benefits: medical (choice of 3 plans), 401(k) starting on day one, a variety of voluntary benefits including life and disability insurance, and sick time if required by law in the worked-in state/locality.