Note: The job is a remote job and is open to candidates in USA. Verixa is a governed-AI workflow platform for regulated life sciences, built for pharmaceutical quality workflows with controlled approvals, human review, source traceability, and audit records. The Application Security Engineer / Penetration Tester will independently conduct a focused secure-code review and authorized penetration test of the multi-tenant SaaS platform, including its web application, REST API, authentication, authorization, tenant isolation, cloud configuration, and AI/LLM risks. The role will produce a defensible findings report, provide remediation guidance, and retest fixes before customer engagement.
Responsibilities
• Authenticated and unauthenticated penetration test of the web application and REST API (OWASP Top 10 / ASVS-aligned)
• Multi-tenant isolation testing (priority) — attempt cross-tenant data access; verify RLS is enforced on every path and that the application tenant-isolation layer cannot be bypassed; probe tenant-scoping on IDs, filters, exports and bulk operations
• Authentication & SSO review (priority) — review the auth flows including any development/mock SSO fallback paths; session handling, token lifecycle, MFA/SSO, password and lockout policy
• Authorization / RBAC review — privilege escalation, IDOR/BOLA, role-boundary and segregation-of-duties enforcement (including on approval, e-signature and disposition actions)
• Secrets & configuration review — secrets handling, default/hardcoded credentials, environment configuration, key management, and any unimplemented secret-provider paths
• Secure code review (targeted) — injection (SQL/command/XSS), audit-trail and e-signature integrity (append-only, non-repudiation), input validation boundaries, error handling and information leakage; review of type-safety debt as a defect-density signal
• AI/LLM-specific risks — prompt injection, cross-tenant data leakage via retrieval/inference, provider egress boundaries, and handling of model inputs/outputs in the audit trail
• Dependency & SAST scan — SCA for known-vulnerable dependencies; static analysis pass with triage of results
• Remediation retest — verify fixes for High/Critical findings after the engineering team remediates
Skills
• • 5+ years hands-on application security / penetration testing, with demonstrable web-app and API pentest experience on multi-tenant SaaS
• • Deep, practical understanding of tenant isolation, RLS, authorization (IDOR/BOLA), and auth/SSO attack patterns
• • Comfortable reading TypeScript/Node and SQL (PostgreSQL); able to do targeted secure code review, not just black-box testing
• • Cloud security fundamentals on AWS
• • Certification such as OSCP, OSWE, GWAPT, GPEN, CREST CRT/CCT (or equivalent demonstrable track record)
• • Ability to write clear, reproducible, developer-actionable reports
• • Can operate independently and to a fixed timeline
• • Prior work in regulated / healthcare / pharma / fintech, or exposure to 21 CFR Part 11 / GxP / data-integrity (ALCOA+) expectations
• • LLM/AI application security experience (prompt injection, RAG data-leakage, provider egress)
• • Experience producing evidence toward SOC 2 / ISO 27001 readiness
Company Overview
• Verixa is a governed-AI workflow platform for regulated life sciences. It was founded in 2026, and is headquartered in Coimbatore, Tamil Nadu, IN, with a workforce of 2-10 employees. Its website is https://www.verixa.ai/.
Apply To This Job