Cloud Security & Compliance Management

The contract requires the implementation and ongoing maintenance of AWS security controls aligned with federal and state regulatory frameworks including IRS Publication 1075, CJIS, HIPAA, and Massachusetts data privacy laws. The scope centers on ensuring that cloud environments hosting sensitive data meet stringent compliance standards through continuous monitoring, periodic audits, and automated vulnerability scanning to detect and remediate security gaps. The work must be performed in Boston, Massachusetts, with strict adherence to local and federal data protection requirements. This is a subcontract under the Massachusetts Executive Office of Technology Services and Security, with a response deadline of September 16, 2026, and falls under NAICS code 541618 for other management consulting services. The contractor is expected to possess deep expertise in securing government data in AWS environments and must demonstrate proficiency in interpreting and applying multiple regulatory standards simultaneously. All activities must support the state’s obligation to protect personally identifiable and health-related information while maintaining operational resilience and audit readiness.