NEARSHORE - Penetration Tester - Web Application & API, manual grey-box pentest of a SaaS platform
Effection Network
Ansprechpartner: Alen Arnautovic
Nürnberg, Deutschland
ITAPIsPenetration TestingSaasCloudtestingEthical HackingOWASPPenetration ToolsWeb-TestsNetzwerk-testsBurp SuiteDynamic Application Security Testing
Beschreibung
Project description
On behalf of a software vendor we are looking for an experienced penetration tester to perform a manual security assessment of a multi-tenant, cloud-based SaaS platform. The platform provides workflow automation, AI-powered agents, data storage, extensions with custom code and integrations with third-party systems. An automated vulnerability scan has already been completed. We are now looking for someone who attacks the platform systematically and according to a documented methodology, both unauthenticated from the outside and authenticated as a user inside a dedicated test tenant, and who documents the identified vulnerabilities in a clear and actionable way.
This is a fully remote engagement. Freelancers based anywhere in the EU or in nearshore locations are explicitly welcome, as long as working hours overlap with CET business hours.
Tasks
- Scoping and creation of a test plan (target systems, roles, test tenant, exclusions, testing windows)
- Manual grey-box penetration test of the web application and its APIs based on OWASP WSTG and OWASP API Security Top 10
- Assessment of authentication, session management, role and permission model and tenant isolation (horizontal and vertical privilege escalation, IDOR, business logic flaws)
- Assessment of integration and extension mechanisms (third-party connections, execution of custom code, file uploads) for SSRF, sandbox escape and remote code execution
- Evaluation of the AI agent features regarding prompt injection and the OWASP Top 10 for LLM Applications
- Delivery of a final report including CVSS ratings, reproduction steps, risk classification and concrete remediation advice, plus a management summary
- Retest after the findings have been fixed
Requirements
- Several years of proven experience in manual web and API penetration testing, ideally with references from SaaS or multi-tenant environments
- Strong hands-on skills with Burp Suite Professional and common pentest tooling
- Structured, methodical approach (OWASP WSTG, PTES or comparable) rather than scanner output only
- Experience with vulnerabilities in low-code or workflow platforms and in AI-powered applications is a plus
- Certifications such as OSCP, OSWE or Burp Suite Certified Practitioner are a plus
- Fluent English for coordination and reporting is required, German is a plus but not mandatory
- Independent, clean documentation and reliable communication with the client's development team
Key facts
- Start: as soon as possible
- Location: 100% remote, EU and nearshore candidates welcome
- Workload: project-based, billed on actual effort
- Please apply with your availability, hourly rate and two to three anonymized reference projects