Security + Privacy Design Reviewer for Early-Stage Multi-Tenant SaaS

I’m building an early-stage multi-tenant SaaS application and need an experienced professional to perform a small, scoped preimplementation Security and Privacy/Data Governance design review. This is not a penetration test, SOC 2 engagement, legal compliance audit, production certification, or ongoing security role. The feature being reviewed has not yet been implemented. The review concerns a narrowly bounded server-side capability for preserving trusted tenant/Organization identity after the application’s existing authentication and Organization validation have succeeded. The proposed capability is designed to be ephemeral, same-process, tenant-bound, nonpersistent, non-serializable, and unavailable as an alternative authentication or authorization mechanism. Security review Please assess the proposed design for authentication/authorization boundary integrity, server-authoritative tenant identity, tenant isolation, capability forgery or substitution, replay/lifecycle risks, issuer/verifier isolation, failure behavior, threat model, residual security risk, and adequacy of the planned adversarial/security testing. Privacy/Data Governance review Please assess Organization-identifier data flow, data minimization, purpose limitation, access boundaries, retention/lifecycle, logging and telemetry exposure, persistence/serialization exclusions, cross-tenant disclosure or inference risk, residual privacy risk, and adequacy of the planned privacy tests. Deliverables I need two separately documented review dispositions: Security Privacy/Data Governance Each review should identify the reviewer, relevant competency/experience, independence or conflicts, materials and scope reviewed, review method, findings, residual risks, and a final disposition of PASS, FAIL, or CONDITIONAL. Any conditions or remediation should be identified. The review should also include the date and an attributable signature or written-record reference. This is a preimplementation design review. Planned controls should be evaluated for design adequacy, but should not be represented as already implemented or verified. Postimplementation verification will be performed separately. Ideal background I’m looking for someone with strong experience in several of the following areas: SaaS/application security architecture Multi-tenant systems Authentication and authorization architecture Application security Threat modeling Privacy engineering or data governance Data-flow/privacy assessments Security design reviews One person may perform both reviews if they have appropriate experience in both domains. When applying, please briefly answer: 1. What experience do you have reviewing authentication and tenant-isolation architecture for multi-tenant SaaS applications? 2. What experience do you have performing privacy, data-flow, or data-governance assessments? 3. Are you comfortable issuing separate written Security and Privacy/Data Governance dispositions of PASS, FAIL, or CONDITIONAL after independently reviewing the evidence? 4. Approximately how many hours would you expect this bounded review to require? Please describe experience relevant to this specific review rather than sending a general cybersecurity proposal.