Security Platform Needs QA/Security Testing

Title: QA / Security Tester for a Cybersecurity SaaS Platform (6 weeks, NDA) Description: We’re an Indian startup building a B2B security SaaS platform covering vulnerability management and AI security. The product is deployed and close to release. We need an experienced tester to check it end to end before our first customers use it. You’ll work from a structured test plan with pass/fail cases and known expected results. The focus is accuracy, not just whether screens load. You’ll check that what the platform reports is correct and complete, and that it fails honestly when it can’t do something. What you’ll test (details shared after NDA): - Sign-in, roles and access control in a multi-tenant SaaS - Making sure one customer can never see another customer’s data, through both UI and API - Vulnerability and asset scanning results compared against reference tools - AI security features, measured with precision and recall on labelled test sets - Integrations, reports, alerts and reliability under load Must have: - 3+ years in QA or security testing, including at least one security product (vulnerability management, CSPM/CNAPP, SAST/SCA or similar) - Hands-on with security tools such as Trivy, Grype, Nessus/OpenVAS, nmap or Burp Suite - Good understanding of CVEs, CVSS, EPSS, CISA KEV and SBOMs - Experience testing authorization in multi-tenant apps (IDOR, role checks) with Postman/curl and browser dev tools - Basic understanding of LLM security risks (OWASP Top 10 for LLM Applications, prompt injection) - Comfortable with Linux and Docker - Clear, reproducible bug reports Nice to have: Kubernetes or cloud experience, test automation (pytest, Playwright), LLM testing tools (garak, promptfoo), DPDP/RBI familiarity, OSCP/CEH/ISTQB. Deliverables: pass/fail results for every test case, a bug log (severity, steps, expected vs actual, screenshots), a weekly summary, and a final report with accuracy numbers per feature. How we’ll work: - Remote, with 3–4 hours of overlap with IST - About 6 weeks, part-time or full-time - NDA before any product details are shared - You test only in our staging environment and isolated lab, never against real third-party systems - Milestone 1 is a short paid trial (a small set of test cases, about 2–3 days). The rest of the engagement follows if it goes well. To apply, start your proposal with the word “TENANT” and answer: 1. Which security products have you tested, and what was your role? 2. How would you test that one customer in a SaaS app can’t see another customer’s data? 3. Give two examples of prompt injection, and how you’d check a detector catches them without flagging normal prompts. 4. If our scanner and Grype report different CVEs for the same container image, how would you decide which is right? 5. Share a sample bug report you’ve written (confidential details removed). Budget: INR 37500–75000