Title: IAM / Permissions Tester — Manual + AI-Assisted Access Control Testing

We're building an access-governance platform (roles, permissions, approval flows, org hierarchy) and need someone to stress-test the permission model before we scale. Your job is to think like an attacker and an auditor: try to make the system do things it shouldn't, and tell us where it lets you. We want two testing styles running in parallel: Manual exploratory testing — click through the product as different roles (Owner, Admin, Team Lead, Member, external contractor) and probe the boundaries by hand. AI-assisted testing — use LLMs/AI tools to generate test matrices, enumerate edge cases, and reason about the permission grammar, then execute and verify the interesting ones. What you'll be testing Privilege escalation: can a lower role grant itself or others more than it holds? Anti-lockout / ownership: can anyone remove or lock out the account owner? Can the last admin lock themselves out? Role boundaries: does each preset role see and do exactly what it should, no more? "Deny" and scoped rules: e.g. "can delete only your own items," "can view a page but not read the data behind it." Cross-org isolation: can a member of one org touch another org's data? The grant surface: are platform-level or internal-only actions ever offered to a regular org? You'll deliver A running log of findings with clear repro steps (role used, action taken, expected vs actual). Severity notes (cosmetic vs. real security gap). The AI prompts / test matrices you used, so we can rerun them. You're a good fit if you have A security-testing or QA mindset and patience for edge cases. Working knowledge of IAM/RBAC/ABAC concepts (AWS IAM, Okta, Auth0, or similar). Comfort using AI tools to design and reason about test cases. Clear written English for reporting. Nice to have: experience with permission systems, pentesting, or compliance/audit work. Logistics: Start with a paid trial task (find and document 3 real permission gaps). Hourly or fixed, your call. Ongoing if the first round goes well.