Security Assurance Engineer

Overture Partners; Boston (MA); On-site; USD 165,000 - 234,000; Full time

Job summary

Overture Partners invites a Security Assurance Engineer for an immediate fixed-term engagement through June 2027, focused on two application modernization programs. You will integrate security requirements, risk assessments, testing, remediation, and release readiness across the SDLC.

The role requires 5+ years in related security disciplines, strong cloud/application security knowledge, and proven ability to deliver measurable security outcomes within project milestones.

Qualifications

• Five or more years in application security, cloud security, or related roles.
• Bachelor's degree in cybersecurity, CS, information systems, or engineering; CISSP or similar cert preferred.
• Ability to define security requirements and assess architectures and data flows.
• Experience coordinating SAST, DAST, pen testing, and vulnerability scans with remediation validation.
• Proven risk analysis, remediation planning, and tracking findings through closure.
• Familiarity with Jira, Salesforce-based apps, Tenable Cloud, Veracode, GitHub and GitHub Copilot.

Responsibilities

• Define project-specific security requirements and acceptance criteria for changes and releases.
• Assess architectures, data flows, cloud services, identity controls, and logging to identify threats.
• Plan and manage application security testing schedules and follow-up activities.
• Triage vulnerabilities, remove duplicates, investigate root causes, and document prioritization.
• Define remediation actions, deadlines, and validation; coordinate with teams to execute.
• Evaluate AI security aspects of RAG pipelines and LLM/voice-enabled services for risks.

Skills

Application security

Cloud security

Security engineering

SAST

DAST

Vulnerability scanning

Remediation planning

Risk analysis

Jira

Veracode

GitHub

GitHub Copilot

Identity management

Data protection

Education

Bachelor's degree

CISSP or similar

Tools

Tenable Cloud

Veracode

GitHub

Jira

Salesforce-based apps

Job description

Security Assurance Engineer (Contract)

Job Overview

An experienced Security Assurance Engineer is needed for an immediate, fixed-term engagement supporting two major application modernization initiatives through June 2027. This project-focused opportunity is suited to a security professional who can integrate security requirements, risk assessments, vulnerability testing, remediation, and release-readiness activities throughout the software delivery lifecycle. Candidates must demonstrate at least five years of relevant experience, strong application and cloud security knowledge, and the ability to deliver documented security outcomes against defined project milestones.

Must Haves

• Professional Experience: Five or more years in application security, cloud security, product security, security engineering, or a closely related discipline.

• Education or Certification: A bachelor's degree in cybersecurity, computer science, information systems, engineering, or a related field. A CISSP or comparable security certification, combined with relevant experience, may satisfy the education requirement.

• Security Engineering: Demonstrated ability to define security requirements, review application architectures and data flows, assess integrations, and evaluate technical controls.

• Security Testing: Experience coordinating static application security testing (SAST), dynamic application security testing (DAST), penetration testing, and vulnerability scanning, including remediation validation.

• Risk and Remediation: Proven capability in risk analysis, vulnerability triage, severity prioritization, remediation planning, implementation support, and tracking findings through closure.

• Technical Tools: Working familiarity with Jira, Salesforce-based applications, Tenable Cloud, Veracode, GitHub, and GitHub Copilot or comparable approved technologies.

• Cloud and Application Controls: Knowledge of identity management, data protection, logging, deployment security, cloud infrastructure, and secure application integrations.

• Communication and Delivery: Strong written and verbal communication skills, accurate evidence management, independent execution, and the ability to coordinate multiple deliverables while escalating risks promptly.

What the Client Needs You to Do

The engagement requires hands-on security assurance across two application modernization programs, covering design, development, testing, remediation, and production readiness. The successful contractor will translate security findings into actionable technical plans, help implement approved controls, and collaborate with engineering teams, application owners, project managers, external vendors, and shared security service providers. Success will be measured through traceable security evidence, timely remediation, documented risk decisions, effective control handoffs, and clear reporting against project commitments.

Key Responsibilities

• Define Security Requirements: Establish project-specific security objectives, control requirements, implementation guidance, and acceptance criteria for application changes and planned releases.

• Assess Technical Risk: Examine architectures, data flows, integrations, cloud services, identity controls, logging, and document-handling processes to identify threats, exposures, and potential business impacts.

• Coordinate Security Testing: Plan and manage application security assessments, penetration tests, vulnerability scans, testing schedules, and follow-up activities.

• Triage Vulnerabilities: Validate reported weaknesses, eliminate duplicates and false positives, investigate root causes, assign severity, identify responsible owners, and document prioritization decisions.

• Develop and Execute Remediation Plans: Define corrective actions, dependencies, deadlines, validation requirements, and compensating controls; implement approved changes when authorized or coordinate execution with designated teams.

• Evaluate AI Security: Assess retrieval-augmented generation (RAG) pipelines, large language model (LLM) applications, and voice-enabled services for prompt injection, data leakage, retrieval poisoning, jailbreaks, and model manipulation.

W2 employees of Overture Partners who work 30 or more hours per week are eligible for the following benefits: medical (choice of 3 plans), 401(k) starting on day one, a variety of voluntary benefits including life and disability insurance, and sick time if required by law in the worked-in state/locality.