Penetration Tester for Database Platform Security Assessment

We are seeking an experienced Penetration Tester to conduct a comprehensive security assessment of our newly migrated database platform. Our organization is transitioning client databases to a new outsourced technology platform under the Arkayo brand, where each client will have their own database instance with custom URLs (e.g., client.arkayo.com). This is a project-based engagement focused on identifying vulnerabilities and ensuring our platform meets enterprise-level security standards before full client rollout. Key Responsibilities ✅ Conduct thorough penetration testing on the newly deployed database platform ✅ Test for common and advanced web application vulnerabilities including OWASP Top 10 ✅ Assess multi-tenancy security to ensure proper isolation between client databases ✅ Perform subdomain enumeration and testing across the custom URL structure ✅ Test authentication and authorization mechanisms for potential bypass vulnerabilities ✅ Evaluate database security including injection vulnerabilities and data leakage risks ✅ Assess API security if applicable to the platform architecture ✅ Provide detailed vulnerability reports with severity ratings and remediation recommendations ✅ Deliver an executive summary suitable for non-technical stakeholders ✅ Offer guidance on security best practices for the platform deployment Requirements ✔ Proven experience as a Penetration Tester or Security Engineer with at least 3-5 years in the field ✔ Strong knowledge of OWASP Top 10 vulnerabilities and testing methodologies ✔ Expertise in web application security testing and common attack vectors ✔ Experience testing multi-tenant SaaS platforms and understanding tenant isolation risks ✔ Proficiency with penetration testing tools such as Burp Suite, OWASP ZAP, Metasploit, Nmap ✔ Strong understanding of database security including SQL injection and NoSQL vulnerabilities ✔ Knowledge of authentication protocols (OAuth, SAML, JWT) and session management ✔ Familiarity with API security testing (REST, GraphQL) ✔ Ability to produce clear, actionable security reports with remediation guidance ✔ Understanding of compliance frameworks such as PCI DSS, SOC2, or similar ✔ Experience with subdomain and DNS security testing ✔ Strong analytical and problem-solving skills Nice to Have ➕ Professional certifications such as OSCP, CEH, GPEN, or GWAPT ➕ Experience with cloud platform security (AWS, Azure, GCP) ➕ Knowledge of containerization security (Docker, Kubernetes) ➕ Familiarity with automated security scanning tools and CI/CD security integration ➕ Experience with secure code review and static analysis ➕ Understanding of network security and infrastructure penetration testing ➕ Previous work securing outsourced or third-party platforms ➕ Experience with bug bounty programs or responsible disclosure practices ➕ Knowledge of social engineering and phishing assessment techniques ➕ Scripting skills in Python, Bash, or PowerShell for custom exploit development