QA Engineer, Security and Multi-Tenant Isolation
- Location: On-site, in Dubai
- Agent Workflow and Permissions Engineer, Gateway Engineer.
The Mission
We are building a highly advanced, centralized AI Governance Orchestration platform. As our Security and Isolation QA, your mission is singular and critical: to prove with repeatable, documented evidence that one client's data can never be accessed by another. Your ultimate deliverable is a signed, unassailable audit report that authorizes our deployment to our first paying enterprise client.
What You Will Do
- Build the Bench: construct and maintain a permanent dual-client testing environment with strictly segregated users, roles, and databases.
- Attack the Boundaries: deliberately attack the boundaries between clients across all access points, not just the graphical interface.
- Vulnerability Hunting: test aggressively for resource ID manipulation, cross-tenant token and ID injection, privilege escalation, cache and queue poisoning, and noisy-neighbor resource exhaustion effects.
- Expose Hidden Leaks: verify absolute data isolation where it silently breaks: background reports, data exports, search functions, file downloads, push notifications, system logs, backup restorations, and hard deletions.
- Verify Per-Client Audit and Observability: prove that telemetry, logs, and every human-approval event are separated and attributable to a single client, in line with our governance law of human control and traceability.
- Automate the Defense: transform every successful manual attack or vulnerability check into an automated test suite that runs on every code release.
- Audit and Document: draft, update, and maintain the official Data Isolation Audit Report.
- Mentor the School: train two internal QA interns on your isolation testing methodologies to prepare them for future deployments.
What We Require
- Proven, hands-on experience in Web and API security testing.
- The ability to read, intercept, and manually modify network requests and payloads, for example Postman or Burp Suite.
- A deep, architectural understanding of Role-Based Access Control and multi-tenant systems.
- Strong proficiency in test automation frameworks.
- Impeccable, highly organized technical writing skills in English for audit reporting.
- A maniacal, detail-oriented methodology. You do not assume a system works, you prove it.
The First 30 Days
- Dual-client test bench fully active and configured.
- Comprehensive list of attack vectors and edge cases mapped out.
- First end-to-end execution of the security suite completed.
- Version 1 of the Audit Report delivered to the CTO, highlighting any weak points and their severity.
Application Question(s):
- Do you have hands-on experience with web/API security testing using tools such as Burp Suite, Postman, or similar tools? Yes / No
- Are you available to work full-time, on-site in Dubai? Yes / No
- Do you have experience testing RBAC, authentication/authorization, multi-tenant systems, or cross-tenant data isolation? Yes / No
Work Location: In person