Cybersecurity Security Analyst - SecOps ; Contracted​/Temporary

This is a 4-month contracted/temporary position.

The Commonwealth of Massachusetts Executive Office of Economic Development (EOED) supports economic growth by fostering business development, infrastructure investment, industry advancement, and consumer confidence. EOED operates through nine state agencies and five quasi‑public agencies (QPAs) that deliver essential public programs and services.

EOED supports economic growth across Massachusetts through its network of agencies and partnerships, promoting business innovation, infrastructure investment, and consumer protection. The office embraces a culture of equity, inclusion, and collaboration—values that inform all aspects of its work.

The Executive Office of Economic Development is committed to creating and sustaining a work culture that is welcoming, inclusive, and mutually respectful to all its employees regardless of race, color, age, creed, religion, national origin, ethnicity, sex, gender identity or expression, sexual orientation, genetic information, veteran or disability status. We strive to reflect diversity in all facets and levels of our agency.

The Executive Office of Economic Development is committed to ensuring a diverse and inclusive workplace where all employees feel respected, valued, and empowered to maximize their skills and talents to serve our citizens.

The Executive Office of Economic Development is seeking a junior‑level Cybersecurity Security Analyst (Contractor) to support day‑to‑day Security Operations (Sec Ops), governance, risk, and compliance activities. This role will provide hands‑on operational support to EOED’s cybersecurity

Denver program under the direction of the EOED Chief Information Security Officer (CISO), and in coordination with the Commonwealth’s Executive Office of Technology Services and Security (EOTSS).

The contractor will work in a fast‑paced public‑sector environment supporting EOED’s mission‑critical systems, data, and users, with a strong emphasis on vulnerability management, identity and access controls, and compliance execution.

Security Operations & Vulnerability Management:

• Reviewing vulnerability scan results.
• Tracking remediation activities.
• Coordinating with IT and application owners on remediation status.
• Assist with vulnerability tooling workflows (e.g., Tenable, Veracode), reporting, and documentation, including updating the Application Inventory records with security metadata, and coordinating stakeholder input.
• Validate remediation actions and update tracking systems accordingly.

Governance, Risk & Compliance (GRC): evolution>

• Evidence collection and documentation. vera^>
• Control mapping and compliance tracking.
• Support Pride audits, assessments, and internal reviews.
• Assist with maintaining compliance artifacts aligned with:
  • NIST Cybersecurity Framework (CSF)
  • NIST Risk Management Framework King RMF
  • Commonwealth of Massachusetts / EOTSS Enterprise Information Security Policies
• Support tracking of risks, findings, and remediation plans in Service Now, Jira, and other EOED‑approved systems.

Identity & Access Management (IAM):

• Assist with user access reviews, role validation, and privileged access reviews.
• Support identity lifecycle activities including onboarding,.each offboarding, and access changes.
• Help ensure access controls align with least privilege and Commonwealth security standards.

Documentation, Coordination & Communication:

• Execute tasks and assignments documented in Jira, Service Now, AIRS, email, and other tracking tools.
• Maintain clear, accurate, and timely documentation of work performed.
• Communicate effectively with technical and non‑technical stakeholders.
• Escalate issues, risks, or blockers appropriately to the EOED CISO.

Additional Support:

• aları assist with other Sec Ops activities as needed, including incident response support, security awareness initiatives, and ad hoc security projects.
• Develop familiarity with EOED systems, data, and business processes, including emerging areas such as AI risk and data security.

• Foundational understanding of information security principles and practices.
• Strong…