Application Security Engineer / Penetration Tester — Contract

Verixa is a governed-AI workflow platform for regulated life sciences, built by Navira Quality Systems. They are seeking an independent application-security specialist to perform secure-code reviews and penetration tests on their platform, ensuring security before engaging with design partners.

Responsibilities:

• Authenticated and unauthenticated penetration test of the web application and REST API (OWASP Top 10 / ASVS-aligned)
• Multi-tenant isolation testing (priority) — attempt cross-tenant data access; verify RLS is enforced on every path and that the application tenant-isolation layer cannot be bypassed; probe tenant-scoping on IDs, filters, exports and bulk operations
• Authentication & SSO review (priority) — review the auth flows including any development/mock SSO fallback paths; session handling, token lifecycle, MFA/SSO, password and lockout policy
• Authorization / RBAC review — privilege escalation, IDOR/BOLA, role-boundary and segregation-of-duties enforcement (including on approval, e-signature and disposition actions)
• Secrets & configuration review — secrets handling, default/hardcoded credentials, environment configuration, key management, and any unimplemented secret-provider paths
• Secure code review (targeted) — injection (SQL/command/XSS), audit-trail and e-signature integrity (append-only, non-repudiation), input validation boundaries, error handling and information leakage; review of type-safety debt as a defect-density signal
• AI/LLM-specific risks — prompt injection, cross-tenant data leakage via retrieval/inference, provider egress boundaries, and handling of model inputs/outputs in the audit trail
• Dependency & SAST scan — SCA for known-vulnerable dependencies; static analysis pass with triage of results
• Remediation retest — verify fixes for High/Critical findings after the engineering team remediates

Requirements:

• 5+ years hands-on application security / penetration testing, with demonstrable web-app and API pentest experience on multi-tenant SaaS
• Deep, practical understanding of tenant isolation, RLS, authorization (IDOR/BOLA), and auth/SSO attack patterns
• Comfortable reading TypeScript/Node and SQL (PostgreSQL); able to do targeted secure code review, not just black-box testing
• Cloud security fundamentals on AWS
• Certification such as OSCP, OSWE, GWAPT, GPEN, CREST CRT/CCT (or equivalent demonstrable track record)
• Ability to write clear, reproducible, developer-actionable reports
• Can operate independently and to a fixed timeline
• Prior work in regulated / healthcare / pharma / fintech, or exposure to 21 CFR Part 11 / GxP / data-integrity (ALCOA+) expectations
• LLM/AI application security experience (prompt injection, RAG data-leakage, provider egress)
• Experience producing evidence toward SOC 2 / ISO 27001 readiness