Pen test for web service (OWASP WSTG)

Penetration test of a web service covering: Dashboard application (login, signup, password reset, etc.) Associated APIs JS SDK (optional, can be scoped separately) The total surface area is relatively small. Estimated effort: 25-40 hours including reconnaissance and reporting. This engagement must satisfy SOC2 Type 2 audit requirements for external penetration testing. Prior experience delivering compliance-driven pentests is required. This will be a black-box engagement against a live production environment. Destructive testing is not permitted. Requirements OSCP, OSWA, OSWE, GPEN, LPT, CEPT, or equivalent high level technical hands-on credentials PCI-DSS experience is a plus NDA required Retesting after remediation (1 round) Target Framework: OWASP WSTG Deliverables: Pentest reports (PDF) - full version and executive summary (2 separate files) Detailed coverage report with findings mapped to OWASP WSTG, including CVSS scores and reproducible PoCs Raw evidence, tool output, and collected data uploaded to a secure location Executive summary and attestation letter Communication Critical or high-severity findings should be reported immediately during the engagement. Timeline All deliverables due by September 11, 2026. If the engagement goes well, we quarterly engagements going forward are a possibility.