In September 2016, then Massachusetts Tax Commissioner Michael J. Heffernan persuaded Governor Charlie Baker’s budget office to authorize a new $121,000-a-year job, despite a government hiring freeze. His agency was anticipating two major technology rollouts, he said, and they were concerned about security threats.
But the woman Heffernan hired — a Wellesley neighbor, friend, and donor to his 2014 campaign for treasurer — had no discernible experience in data security or technology, according to documents obtained by the Globe.
The resume Kristin Lindquist submitted to get the Department of Revenue job — which the administration refused to release but a copy of which was obtained by the Globe — highlights professional credentials that are rooted in her jobs as a portfolio manager and securities trader for two major financial firms in the 1980s and 1990s.
Lindquist, who took on the title of associate deputy commissioner, administrative affairs and chief risk officer, had not held a full-time job since 2002.
Since Lindquist was hired, the Department of Revenue has encountered significant glitches in two of its new technology systems: one that inadvertently made private information about 39,000 business taxpayers visible to other companies, and another that failed to deliver timely child support payments to about 1,500 parents.
Administration aides say Lindquist had no involvement in either; her role, they said, is to investigate what went wrong.
But in 2016, the written justification that Heffernan used for the new position states the agency needed a new official to deal directly in managing risk, such as data security breaches, and protect it from threats to its digital security.
“With the two (2) major technology rollouts scheduled in the next twelve months (12) and recent increases in IT security threats, there is a need for additional administrative and risk management,’’ stated the justification, a copy of which was obtained by the Globe.
Aides for Heffernan, whom Baker elevated to be his budget chief last year, would neither confirm nor deny the authenticity of the written justification.
Instead, Baker’s aides released a waiver request sent to the budget office, which was required to specifically bring on Lindquist during the state government hiring freeze in 2016. In justifying her hiring, the tax agency said Lindquist “possesses the knowledge, skills, and management experience to monitor and advance the agency’s technological and operational changes.”
Heffernan’s aides said he would not comment about his decision to appoint Lindquist. Calls made to Lindquist’s cellphone, home, and office were not returned.
Current revenue commissioner and Heffernan successor and protege Christopher C. Harding responded via a statement, saying Lindquist had no role in the problems that created the breach.
“Kristin Lindquist was hired with a strong background of fifteen years in financial management and processes at major financial institutions,’’ Harding said. “In her DOR role, she had no involvement in the events that caused the recent security vulnerability, and in fact it is her team that is leading the internal investigation to ensure both accountability and ongoing integrity of the system.”
But as the DOR’s chief risk officer, Lindquist participated in the agency’s 20-member executive steering committee, which oversaw the rollout of the system that allowed the business taxpayer breach. The committee meets regularly for “general management of the system,” although Baker aides said Lindquist could not be held accountable for failing to identify the potential security risks that led to the breach last fall.
The breach made financially sensitive information of 39,000 companies viewable by other businesses, potentially their competitors. Warnings from businesses that became aware of the breach went unheeded by the DOR for months.
The Baker administration’s decision to not release Lindquist’s resume runs contrary to the promise the governor made as a candidate in 2014 to be transparent in state government hiring.
At the time, Baker said he would give the Beacon Hill culture “strong medicine” to cure its political employment practices and “root out patronage.”
Baker aides say the resumes that applicants use to get state jobs are not covered by the state’s public records law, even when redacted of sensitive information. It is a legal claim sharply disputed by the secretary of state’s Public Records Division.
The copy of Lindquist’s resume obtained by the Globe states she worked as a portfolio manager at Mellon Financial in Boston from 1991 to 2002. Before that she was a junior trader and assistant vice president at Shawmut Bank. She consulted for several months in early 2016 for an asset management firm.
Despite repeated requests by the Globe, administration aides did not point to anything in her professional background to demonstrate her qualifications for the job other than her work as a portfolio manager.
Lindquist and her husband, Jeffrey, are friends of Heffernan and his wife, Margaret, Baker administration officials confirmed.
They donated $1,000 to Heffernan in 2014, when Baker handpicked him to run for state treasurer on the Republican ticket with him. The couple live in Wellesley, a half-mile from the Heffernans. She attended Heffernan’s private swearing-in as Baker’s budget chief in the governor’s office in August.
Administration officials confirmed that the job Lindquist filled was never posted — not a requirement for a management position like this — nor were other candidates interviewed.
Frank Phillips can be reached at firstname.lastname@example.org.