End-to-End Application cyber Security Team

Project Summary: We are developing a new application and need a specialized 2–3 person cybersecurity team to implement end-to-end security alongside our developers. This covers threat modeling, DevSecOps pipeline setup, API/cloud hardening, and pre-launch penetration testing. Scope of Work: 1. Security Architecture & Threat Modeling: Map data flows, auth mechanisms (JWT/OAuth), and define security baselines. 2. DevSecOps & Cloud Security: Integrate automated SAST/DAST tools into CI/CD and harden cloud infrastructure (AWS/GCP) using least-privilege access. 3. Penetration Testing: Conduct manual and automated gray-box pentests across web/mobile endpoints and APIs (OWASP Top 10). 4. Remediation & Re-testing: Provide actionable fix guidance and perform a final validation re-test. Candidate Screening Questions (Please answer when applying): 1. Team Roles: Across your 2–3 person squad, who handles architecture/DevSecOps, who handles offensive testing, and who leads communication? 2. Testing Methodology: What percentage of your penetration testing is manual vs. automated scanners? 3. Sample Work: Can you share a redacted sample of a past penetration testing/audit report showing CVSS scores and remediation steps? 4. Re-testing: Does your proposal include a free validation re-test once our developers fix the reported vulnerabilities? 5. Access & Security: Are all members willing to sign a strict NDA and adhere to formal Rules of Engagement (RoE) prior to project kickoff?

Requirements

Proven track record in mobile/web app security and DevSecOps. Relevant industry certifications preferred (OSCP, CISSP, CEH, AWS/GCP Security). Work conducted strictly in staging/sandbox environments with synthetic data.