Back to all jobs

Certified Penetration Tester for Web Application Security Assessment

Reddit r/forhire
Apply NowSign in to track
AI-enhanced for better readability

[Hiring] Certified Cybersecurity Freelancer / Penetration Tester

Source: reddit-r-forhire

About the Role

I am looking for a certified penetration tester (freelance or small firm, remote, any location) to run an application security assessment of a multi-tenant B2B compliance SaaS platform built for EU financial institutions. The output will support our clients' ICT third-party risk assessments under DORA (Art. 28–30) and KNF Recommendation D.

Scope

  • Web Application & API Testing: Authenticated testing against OWASP WSTG / ASVS Level 2.
  • Focus Areas: Authentication and session management, authorisation and IDOR across 4–5 user roles, tenant isolation between client institutions, business logic flaws, file upload, and the confidentiality of the anonymous whistleblowing channel.
  • AI Assistant Feature: Prompt injection and data leakage testing (OWASP LLM Top 10).
  • Environment: Staging environment mirroring production; test accounts provided for each role; no real client data.

Deliverables

  1. Technical Report: Findings with CVSS v3.1/v4.0 scores, reproduction steps, evidence, and remediation guidance, plus the methodology, scope, and test dates.
  2. Executive Summary & Attestation: A signed attestation letter suitable for bank vendor due diligence, including the tester's name, certification IDs, and a statement of independence from the platform's developers.
  3. Re-test: Re-test of all findings within 30 days of the report, with an updated attestation letter showing remediation status.

Note: Automated scanner output alone will not be accepted. Manual testing of the business logic and authorisation is the core of this engagement.

Requirements

  • Certifications: Hands-on offensive certifications (e.g., OSCP, OSWE, BSCP, CREST CRT/CCT, eWPTX, GWAPT). These will be verified.
  • Experience: A reference from a fintech, bank, or other regulated client is preferred.
  • Compliance: Willing to sign an NDA and rules of engagement. Professional indemnity insurance is a plus.

Timeline

  • Testing Start: 1 December 2026
  • Report Deadline: 15 December 2026

Budget & Payment

  • Budget: Up to $1,200. Please quote a fixed price for the scope above, including your estimated tester-days.
  • Payment Terms: Two milestones (70% on report delivery, 30% after the re-test) via Wise, Revolut, or SEPA/SWIFT bank transfer, against an invoice.

How to Apply

DM me with the following:

  • Your certifications (with verification links)
  • A short overview of relevant experience
  • A sanitised sample report
  • An indicative quote and availability

Only shortlisted candidates will be contacted.

Similar jobs