One-day penetration test - fintech API + iOS app - AU-based OSCP required

We need a small, tightly scoped penetration test to satisfy a contractual compliance requirement with our open banking data provider. Fixed price, one day of testing (6-8 hours) plus the report. About us: we're an Australian fintech startup (personal finance forecasting app, iOS). One Django REST API, one iOS app, AWS in the Sydney region. Small attack surface, no legacy. SCOPE (grey-box, tested from the public internet - credentials and a test account provided): 1. Production REST API - authentication, session handling, access control (multi-tenant data isolation), OWASP Top 10. 2. iOS app (TestFlight build supplied) - transport security, local data storage, auth token handling. Light review, not a full mobile audit. 3. One inbound webhook endpoint (our banking-data integration) - authentication and input handling. 4. External surface of the AWS environment behind the above (ap-southeast-2) - exposed services only. OUT OF SCOPE: social engineering, denial of service, physical security, source code review, internal network, our marketing website, and any third-party systems (including our data provider's platform). DELIVERABLE: A formal PDF report on your letterhead containing: - severity-rated findings with reproduction steps - a short summary of material issues - a statement of your qualifications (OSCP) and independence from our company No retest required. We will handle remediation ourselves. REQUIREMENTS: - Based in Australia - OSCP certified (please include your certification number) - ABN for invoicing - A sample report (redacted is fine) TIMEFRAME: within the next 2 weeks. TO APPLY, please tell us: 1. Your fixed price for the scope above 2. Your earliest available start date 3. Your OSCP number 4. A redacted sample report Please don't propose an expanded scope or an ongoing retainer - we need exactly the above, done once.