Note: The job is a remote job and is open to candidates in USA. Verixa is a governed-AI workflow platform for regulated life sciences, built for pharmaceutical quality workflows with controlled approvals, human review, source traceability, and audit records. The Application Security Engineer / Penetration Tester will independently conduct a focused secure-code review and authorized penetration test of the multi-tenant SaaS platform, including its web application, REST API, authentication, authorization, tenant isolation, cloud configuration, and AI/LLM risks. The role will produce a defensible findings report, provide remediation guidance, and retest fixes before customer engagement.
Responsibilities
- Authenticated and unauthenticated penetration test of the web application and REST API (OWASP Top 10 / ASVS-aligned)
- Multi-tenant isolation testing (priority) — attempt cross-tenant data access; verify RLS is enforced on every path and that the application tenant-isolation layer cannot be bypassed; probe tenant-scoping on IDs, filters, exports and bulk operations
- Authentication & SSO review (priority) — review the auth flows including any development/mock SSO fallback paths; session handling, token lifecycle, MFA/SSO, password and lockout policy
- Authorization / RBAC review — privilege escalation, IDOR/BOLA, role-boundary and segregation-of-duties enforcement (including on approval, e-signature and disposition actions)
- Secrets & configuration review — secrets handling, default/hardcoded credentials, environment configuration, key management, and any unimplemented secret-provider paths
- Secure code review (targeted) — injection (SQL/command/XSS), audit-trail and e-signature integrity (append-only, non-repudiation), input validation boundaries, error handling and information leakage; review of type-safety debt as a defect-density signal
- AI/LLM-specific risks — prompt injection, cross-tenant data leakage via retrieval/inference, provider egress boundaries, and handling of model inputs/outputs in the audit trail
- Dependency & SAST scan — SCA for known-vulnerable dependencies; static analysis pass with triage of results
- Remediation retest — verify fixes for High/Critical findings after the engineering team remediates
Skills
- • 5+ years hands-on application security / penetration testing, with demonstrable web-app and API pentest experience on multi-tenant SaaS
- • Deep, practical understanding of tenant isolation, RLS, authorization (IDOR/BOLA), and auth/SSO attack patterns
- • Comfortable reading TypeScript/Node and SQL (PostgreSQL); able to do targeted secure code review, not just black-box testing
- • Cloud security fundamentals on AWS
- • Certification such as OSCP, OSWE, GWAPT, GPEN, CREST CRT/CCT (or equivalent demonstrable track record)
- • Ability to write clear, reproducible, developer-actionable reports
- • Can operate independently and to a fixed timeline
- • Prior work in regulated / healthcare / pharma / fintech, or exposure to 21 CFR Part 11 / GxP / data-integrity (ALCOA+) expectations
- • LLM/AI application security experience (prompt injection, RAG data-leakage, provider egress)
- • Experience producing evidence toward SOC 2 / ISO 27001 readiness
Company Overview