Security Platform Needs QA/Security Testing
Budget / Salary₹37,500–75,000
TypeFreelance project
LocationRemote
Posted1 hour ago
Title: QA / Security Tester for a Cybersecurity SaaS Platform (6 weeks, NDA)
Description:
We’re an Indian startup building a B2B security SaaS platform covering vulnerability management and AI security. The product is deployed and close to release. We need an experienced tester to check it end to end before our first customers use it.
You’ll work from a structured test plan with pass/fail cases and known expected results. The focus is accuracy, not just whether screens load. You’ll check that what the platform reports is correct and complete, and that it fails honestly when it can’t do something.
What you’ll test (details shared after NDA):
- Sign-in, roles and access control in a multi-tenant SaaS
- Making sure one customer can never see another customer’s data, through both UI and API
- Vulnerability and asset scanning results compared against reference tools
- AI security features, measured with precision and recall on labelled test sets
- Integrations, reports, alerts and reliability under load
Must have:
- 3+ years in QA or security testing, including at least one security product (vulnerability management, CSPM/CNAPP, SAST/SCA or similar)
- Hands-on with security tools such as Trivy, Grype, Nessus/OpenVAS, nmap or Burp Suite
- Good understanding of CVEs, CVSS, EPSS, CISA KEV and SBOMs
- Experience testing authorization in multi-tenant apps (IDOR, role checks) with Postman/curl and browser dev tools
- Basic understanding of LLM security risks (OWASP Top 10 for LLM Applications, prompt injection)
- Comfortable with Linux and Docker
- Clear, reproducible bug reports
Nice to have: Kubernetes or cloud experience, test automation (pytest, Playwright), LLM testing tools (garak, promptfoo), DPDP/RBI familiarity, OSCP/CEH/ISTQB.
Deliverables: pass/fail results for every test case, a bug log (severity, steps, expected vs actual, screenshots), a weekly summary, and a final report with accuracy numbers per feature.
How we’ll work:
- Remote, with 3–4 hours of overlap with IST
- About 6 weeks, part-time or full-time
- NDA before any product details are shared
- You test only in our staging environment and isolated lab, never against real third-party systems
- Milestone 1 is a short paid trial (a small set of test cases, about 2–3 days). The rest of the engagement follows if it goes well.
To apply, start your proposal with the word “TENANT” and answer:
1. Which security products have you tested, and what was your role?
2. How would you test that one customer in a SaaS app can’t see another customer’s data?
3. Give two examples of prompt injection, and how you’d check a detector catches them without flagging normal prompts.
4. If our scanner and Grype report different CVEs for the same container image, how would you decide which is right?
5. Share a sample bug report you’ve written (confidential details removed).
Description:
We’re an Indian startup building a B2B security SaaS platform covering vulnerability management and AI security. The product is deployed and close to release. We need an experienced tester to check it end to end before our first customers use it.
You’ll work from a structured test plan with pass/fail cases and known expected results. The focus is accuracy, not just whether screens load. You’ll check that what the platform reports is correct and complete, and that it fails honestly when it can’t do something.
What you’ll test (details shared after NDA):
- Sign-in, roles and access control in a multi-tenant SaaS
- Making sure one customer can never see another customer’s data, through both UI and API
- Vulnerability and asset scanning results compared against reference tools
- AI security features, measured with precision and recall on labelled test sets
- Integrations, reports, alerts and reliability under load
Must have:
- 3+ years in QA or security testing, including at least one security product (vulnerability management, CSPM/CNAPP, SAST/SCA or similar)
- Hands-on with security tools such as Trivy, Grype, Nessus/OpenVAS, nmap or Burp Suite
- Good understanding of CVEs, CVSS, EPSS, CISA KEV and SBOMs
- Experience testing authorization in multi-tenant apps (IDOR, role checks) with Postman/curl and browser dev tools
- Basic understanding of LLM security risks (OWASP Top 10 for LLM Applications, prompt injection)
- Comfortable with Linux and Docker
- Clear, reproducible bug reports
Nice to have: Kubernetes or cloud experience, test automation (pytest, Playwright), LLM testing tools (garak, promptfoo), DPDP/RBI familiarity, OSCP/CEH/ISTQB.
Deliverables: pass/fail results for every test case, a bug log (severity, steps, expected vs actual, screenshots), a weekly summary, and a final report with accuracy numbers per feature.
How we’ll work:
- Remote, with 3–4 hours of overlap with IST
- About 6 weeks, part-time or full-time
- NDA before any product details are shared
- You test only in our staging environment and isolated lab, never against real third-party systems
- Milestone 1 is a short paid trial (a small set of test cases, about 2–3 days). The rest of the engagement follows if it goes well.
To apply, start your proposal with the word “TENANT” and answer:
1. Which security products have you tested, and what was your role?
2. How would you test that one customer in a SaaS app can’t see another customer’s data?
3. Give two examples of prompt injection, and how you’d check a detector catches them without flagging normal prompts.
4. If our scanner and Grype report different CVEs for the same container image, how would you decide which is right?
5. Share a sample bug report you’ve written (confidential details removed).
Apply on Freelancer →
Project sourced from Freelancer.com. Applications happen directly on the original platform — we never collect your data.