EOED Security Assurance Engineer

Job#: 3055259

Job Description:

Apex Systems is a world class technology services business that incorporates industry or insights and experience to deliver solutions that fulfill our clients' digital visions.

Apex has an opportunity for an Security Assurance Engineer. For applicants who are interested in this opportunity, send your updated resume to Gabriel Ortega, Account Manager, at .

Here are the details:

Position: Security Assurance Engineer

Client: Commonwealth of MA (Executive Office of Economic Development)

Location: Boston, MA (Hybrid)

Duration: Thru 6/30/27 (with possibility of extension)

Pay rate: $85-$92/hour

Position Summary:

Executive Office of Economic Development (EOED)

JOB TITLE: Security Assurance Engineer (Contractor - Division of Banks and Consumer Modernization)

The Executive Office of Economic Development (EOED) is seeking an experienced Security Assurance Engineer (Contractor) to provide fixed-term security delivery capacity for two active fiscal year 2027 capital projects: the Division of Banks Application Portfolio Modernization and Consumer & Contractor Interaction Modernization. Reporting to the EOED Chief Information Security Officer (CISO), the contractor will work with the project teams to build security requirements, risk analysis, security testing, vulnerability triage, remediation planning and implementation, control implementation, and release-readiness activities into the delivery schedule.

The role will provide project-scoped security assurance from design through deployment. The contractor will analyze and triage risks, develop and help implement remediation plans and technical controls, guide agency personnel who own and operate those controls, and verify closure and residual-risk decisions. The engagement is dedicated project delivery capacity for the two named modernization efforts and is not a substitute for recurring security operations or unallocated staff augmentation.

Position Details

Job Title: Security Assurance Engineer (Contractor - Division of Banks and Consumer Modernization)

Engagement Term: through June 30, 2027 (with possibility of extension)

Estimated Level of Effort: Approximately 1,254 hours over the engagement

Work Schedule: Project-based allocation; monthly hours will vary according to approved milestones, release windows, testing schedules, and unresolved findings

Work Model: Hybrid and Massachusetts-based, with on-site attendance as project needs require

Reporting To: EOED Chief Information Security Officer (CISO)

Primary Assignments: Division of Banks Application Portfolio Modernization and Consumer & Contractor Interaction Modernization

Position Type: Fixed-term contractor / consulting services

Key Responsibilities

Security Requirements, Risk Analysis, and Control Implementation

Define and document project security requirements, control objectives, implementation details, and acceptance criteria for planned releases and production changes.

Review application architecture, data flows, integrations, and control designs across applications, databases, Amazon Web Services (AWS), Salesforce-based applications, artificial intelligence (AI)-enabled services, identity, logging, infrastructure, and document handling.

Perform project-specific risk analyses that evaluate threat scenarios, exploitability, exposure, data sensitivity, business and regulatory impact, existing controls, and release dependencies. Document inherent and residual risks with recommended treatment options.

Implement approved project-scoped security controls and technical safeguards when assigned. Guide agency personnel on control ownership, configuration, operation, evidence collection, exception handling, and transition to ongoing management.

Vulnerability Testing, Triage, and Remediation

Coordinate static application security testing (SAST), dynamic application security testing (DAST), penetration testing, and vulnerability scanning, including scope, schedules, tool configuration, participants, findings, and follow-up.

Analyze and triage findings from Tenable Cloud, Veracode static and dynamic testing, GitHub, testing providers, and other approved sources. Validate findings, identify false positives and duplicates, analyze root causes and affected components, determine severity and release priority, identify owners, and record the rationale in Jira or the applicable tracking system.

Develop remediation plans with clear technical actions, owners, priorities, dependencies, target dates, validation steps, and any required compensating controls or risk decisions.

Assess RAG pipelines and LLM-based solutions, identifying vulnerabilities - prompt injection, data leakage, retrieval poisoning, model behavior manipulation.

Design & execute adversarial tests for model robustness, red-team simulations, jailbreak attempts, evaluate guardrails

Implement approved project-scoped remediations and controls directly when authorized, or work hands-on with responsible agency personnel and vendors when access or separation-of-duties requirements assign change execution elsewhere. Verify closure through retesting and evidence review. Collaborate with engineering team as required.

Use approved AI-assisted techniques and GitHub Copilot, where appropriate, to support vulnerability testing, secure code review, test-case development, or remediation analysis. Validate results and follow Commonwealth and EOED data-handling requirements.

Escalate material findings, blocked remediation, and decisions that could affect project milestones or go-live readiness to project leadership and the EOED CISO.

Shared Security Services Coordination

Work within EOED's managed security service provider (MSSP) relationship with the Executive Office of Technology Services and Security (EOTSS) to coordinate service intake, testing scope, access, scheduling, escalation, evidence exchange, remediation, retesting, and closure.

Coordinate with EOTSS security and technology teams as required, apply applicable EOTSS policies and standards, and clarify responsibilities and handoffs among EOED, EOTSS, project teams, and vendors.

Translate EOTSS and MSSP findings into project-specific priorities and action plans, track dependencies, and escalate service constraints that could affect a release or remediation deadline.

Division of Banks Application Portfolio Modernization Support

Support security review and release readiness for the Nationwide Multistate Licensing System (NMLS), Online Annual Reporting System (OARS), and Regulatory Management System (RMS) modernization work, including application, platform, identity, data, logging, and deployment controls.

Coordinate testing and vulnerability remediation for project changes and validate the evidence required for production acceptance.

Consumer & Contractor Interaction Modernization Support

Support security design and testing for the Massachusetts Contractor Hub, Lemon Law portal, Home Improvement Contractor (HIC) Hotline AI Voice Agent, and Department of Telecommunications and Cable (DTC) consumer complaint workflows.

Review Salesforce, AWS, AI-service, integration, identity, and document-upload risks and verify go-live readiness for public-facing workflows.

Release Readiness and Risk Documentation

Prepare documented risk analyses, triage decisions, security review results, testing evidence, control implementation records, remediation plans and status, and release-readiness records for each project.

Verify that project-scoped Critical and High findings are remediated, retested, or formally accepted before go-live.

Present residual risks and recommended decisions to the appropriate EOED risk-acceptance authority, and coordinate deliverable acceptance with the EOED CISO or designated project owner.

The contractor does not independently accept residual risk or authorize production deployment.

Confirm that agency control owners understand continuing responsibilities and receive the procedures, evidence expectations, and transition information needed to manage implemented controls.

Project Controls and Reporting

Associate each supported work item with a project code, defined deliverable, acceptance criteria, and production or asset-in-service cutoff.

Provide monthly reporting by project code showing hours, completed security deliverables, testing completed, findings addressed, open findings and risks, upcoming decisions, and release-readiness evidence.

Coordinate with EOED and agency project managers, product owners, architects, developers, testing teams, application owners, agency control owners, vendors, and EOTSS security and shared-service personnel.

Provide limited support to closely related capital security work only when it does not displace commitments to the two primary projects.

Role Boundaries

The role may implement or support remediation and controls tied to approved project deliverables. It does not own routine enterprise scanning, generic vulnerability backlog work, broad policy maintenance, or unrelated incident response.

The role does not provide recurring access reviews, standing audit support, general security awareness training, or other ongoing operational duties.

Post-go-live monitoring and maintenance are outside scope unless separately approved as a defined project transition deliverable.

Required Qualifications

Five or more years of professional experience in application security, cloud security, product security, security engineering, or a closely related field.

Bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field. A Certified Information Systems Security Professional (CISSP) credential, or a comparable security certification, together with relevant professional experience will be considered equivalent to the bachelor's degree requirement.

Demonstrated experience defining security requirements and reviewing application architectures, data flows, integrations, and technical controls.

Experience coordinating SAST, DAST, and penetration testing and validating remediation or retest evidence.

Demonstrated experience performing risk analysis and vulnerability triage, developing remediation plans, implementing or supporting technical remediation, and tracking findings to closure.

Experience implementing security controls and guiding agency or business personnel on control ownership, operation, evidence, exceptions, and ongoing management.

Working familiarity with Jira, Salesforce-based applications, Tenable Cloud, Veracode static and dynamic testing, GitHub, and GitHub Copilot or comparable approved tools.

Experience using AI-assisted capabilities responsibly for vulnerability testing, source-code or configuration review, finding analysis, or remediation planning.

Working knowledge of identity, data protection, logging, deployment, cloud, and infrastructure controls for complex applications.

Experience documenting security findings, residual risk, control decisions, and production-readiness recommendations.

Experience coordinating security work across project teams, vendors, shared-service organizations, and managed security service providers.

Ability to manage concurrent work against milestones, release schedules, acceptance criteria, and project reporting requirements.

Excellent written and verbal communication skills, including the ability to explain technical risks to technical and non-technical stakeholders.

Ability to work independently, maintain accurate evidence, and escalate risks or blockers promptly.

Preferred Qualifications

Experience securing AWS, Salesforce, public-facing digital services, or regulated application environments.

Experience supporting legacy-platform modernization, cloud re-platforming, or complex application integrations.

Experience working with AI solutions and infrastructure - (RAG pipelines, LLM models, Voice Models)

Familiarity with security considerations for AI-enabled services, document uploads, constituent data, and regulated workflows.

Hands-on experience using Jira, Tenable Cloud, Veracode, GitHub, GitHub Copilot, and Salesforce-based applications in an enterprise or public-sector delivery environment.

Knowledge of National Institute of Standards and Technology (NIST) security frameworks and Commonwealth of Massachusetts or EOTSS security policies and standards.

Prior experience in state government, the public sector, financial services, consumer protection, or another regulated environment.

Relevant certifications such as CISSP, Certified Cloud Security Professional (CCSP), Certified Secure Software Lifecycle Professional (CSSLP), or a comparable application, cloud, or security engineering credential.

Experience coordinating work across internal teams, systems integrators, vendors, and independent testing providers.

Performance Expectations and Deliverables

Security input is provided during design and build, not only at the end of delivery.

Each project has documented security requirements, risk analyses, triage decisions, review results, testing records, control evidence, and clear risk decisions before production.

Remediation plans identify accountable owners, priorities, dependencies, target dates, and validation steps, and approved remediations are implemented and tracked to closure.

Project-scoped Critical and High findings are remediated and retested, addressed through approved compensating controls, or formally accepted before go-live.

Implemented controls are documented, supported by evidence, and transitioned to agency personnel with clear operating and management guidance.

Release-readiness evidence is complete, accurate, traceable to acceptance criteria, and available for management review.

EOTSS service requests, findings, escalations, dependencies, and handoffs are tracked through the applicable EOED and MSSP workflows.

AI-assisted testing and analysis are independently validated and performed only through EOED-approved tools and processes.

Monthly reporting clearly shows hours, completed deliverables, testing performed, findings addressed, open risks, and upcoming decisions by project code.

Work remains focused on the two primary projects unless the CISO approves a limited, non-displacing adjacent capital assignment.

Location Details

1 Ashburton Pl., Boston, MA. This is a contract role and can be hybrid, with 2-3 days/week mandatory in the office in Boston that might vary from week to week, depending on vendor and team meetings. Minimum 3 days/week mandatory in office for first 90 days.

EEO Employer

Apex Systems is an equal opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Apex will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law. If you have visited our website in search of information on employment opportunities or to apply for a position, and you require an accommodation in using our website for a search or application, please contact our Employee Services Department at or .

Everforth Apex is a world-class IT services company that serves thousands of clients across the globe. When you join Everforth Apex, you become part of a team that values innovation, collaboration, and continuous learning. We offer quality career resources, training, certifications, development opportunities, and a comprehensive benefits package. Our commitment to excellence is reflected in many awards, including ClearlyRateds Best of Staffing in Talent Satisfaction in the United States and Great Place to Work in the United Kingdom and Mexico.

Everforth Apex uses a virtual recruiter as part of the application process. Click for more details. By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from Everforth Apex and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at

Everforth Apex Benefits Overview: Everforth Apex offers a range of supplemental benefits, including medical, dental, vision, life, disability, and other insurance plans that offer an optional layer of financial protection. We offer an ESPP (employee stock purchase program) and a 401K program which allows you to contribute typically within 30 days of starting, with a company match after 12 months of tenure. Everforth Apex also offers a HSA (Health Savings Account on the HDHP plan), a SupportLinc Employee Assistance Program (EAP) with up to 8 free counseling sessions, a corporate discount savings program and other discounts. In terms of professional development, Everforth Apex hosts an on-demand training program, provides access to certification prep and a library of technical and leadership courses/books/seminars once you have 6+ months of tenure, and certification discounts and other perks to associations that include CompTIA and IIBA. Everforth Apex has a dedicated customer service team for our Consultants that can address questions around benefits and other resources, as well as a certified Career Coach. You can access a full list of our benefits, programs, support teams and resources within our 'Welcome Packet' as well, which an Everforth Apex team member can provide.

Everforth Apex Systems is an equal opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Everforth Apex will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law.

If you require an accommodation under the Americans with Disabilities Act to participate in an interview with a virtual recruiter or to use our website for a search or application, please contact our Benefits Department at or . Please note that this contact information is strictly to be used for medical ADA accommodations and that no other inquiries will be answered.

UnitedHealthcare creates and publishes the Transparency in Coverage Machine-Readable Files on behalf of Everforth Apex Systems.