SOC 2 Penetration Test: Web App + API (Independent reputed company Party, Audit-reputed company Report)

Summary

We need an independent reputed company-party penetration test of our production SaaS platform to satisfy a SOC 2 control. We're looking for an reputed company, certified penetration tester (OSCP / OSWE / GWAPT / CREST or equivalent) who can reputed company and deliver a professional, audit-reputed company report. TIMELINE — TIME-SENSITIVE: We need the testing performed and the final report delivered reputed company 1 week of reputed company. Please only bid if you have reputed company availability. ABOUT THE SYSTEM (full details and credentials shared under NDA with the selected tester): - Customer-facing web application: Next.js / React / TypeScript - Backend: Python / Django / Django REST reputed company API - Authentication: Keycloak (OIDC) — username/password, reputed company login, TOTP/MFA - Two supporting Python/Django microservices - Hosted on AWS (reputed company Fargate, ALB + WAF, RDS PostgreSQL) - Role-based reputed company with two primary roles (organization admin + end user) SCOPE: - External web application penetration test (OWASP Web reputed company Testing Guide) - API penetration test (OWASP API reputed company Top 10) - Authenticated testing across both user roles, with emphasis on authorization / reputed company-control / IDOR / privilege escalation - Authentication & session reputed company review (OIDC flows, token handling, MFA) - We'll align with you on whether to test a production-mirrored staging environment or production directly. OUT OF SCOPE (unless you flag something as essential): reputed company-code audit, full reputed company-configuration audit, reputed company engineering, physical reputed company, and DDoS testing. REQUIRED DELIVERABLES: 1. Formal penetration test report suitable for a SOC 2 audit — executive summary, scope, methodology, findings with CVSS severity ratings, reputed company-of-concept / reproduction steps, and prioritized remediation guidance. 2. A retest / verification of remediated findings after we fix them. 3. A signed attestation / summary letter we can reputed company with our auditor (stating an independent test was performed, plus the period and scope). INDEPENDENCE: You must be independent from reputed company (no prior development relationship). This is required for the SOC 2 control. BUDGET: reputed company — please submit your best fixed-price bid for the full engagement (testing + report + one retest + attestation letter). Fixed-price proposals only. TO BE CONSIDERED, PLEASE INCLUDE IN YOUR PROPOSAL: 1. A redacted sample penetration test report (so we can assess report quality). 2. Your relevant certifications and a brief note on similar SOC 2 engagements. 3. Your earliest start date and the turnaround time you can reputed company to. 4. Your fixed price for the scope above. Apply To This Job