End-to-End Application cyber Security Team

Project Summary:
We are developing a new application and need a specialized 2–3 person cybersecurity team to implement end-to-end security alongside our developers. This covers threat modeling, DevSecOps pipeline setup, API/cloud hardening, and pre-launch penetration testing.
Scope of Work:
1. Security Architecture & Threat Modeling: Map data flows, auth mechanisms (JWT/OAuth), and define security baselines.
2. DevSecOps & Cloud Security: Integrate automated SAST/DAST tools into CI/CD and harden cloud infrastructure (AWS/GCP) using least-privilege access.
3. Penetration Testing: Conduct manual and automated gray-box pentests across web/mobile endpoints and APIs (OWASP Top 10).
4. Remediation & Re-testing: Provide actionable fix guidance and perform a final validation re-test.
Candidate Screening Questions (Please answer when applying):
1. Team Roles: Across your 2–3 person squad, who handles architecture/DevSecOps, who handles offensive testing, and who leads communication?
2. Testing Methodology: What percentage of your penetration testing is manual vs. automated scanners?
3. Sample Work: Can you share a redacted sample of a past penetration testing/audit report showing CVSS scores and remediation steps?
4. Re-testing: Does your proposal include a free validation re-test once our developers fix the reported vulnerabilities?
5. Access & Security: Are all members willing to sign a strict NDA and adhere to formal Rules of Engagement (RoE) prior to project kickoff?
Requirements:
Proven track record in mobile/web app security and DevSecOps.
Relevant industry certifications preferred (OSCP, CISSP, CEH, AWS/GCP Security).
Work conducted strictly in staging/sandbox environments with synthetic data.

---
來源：Freelancer.com | 出價次數：0 | 剩餘時間：7 日 | 專案類型：固定預算