Independent penetration test with remediation retest, report for enterprise vendor risk review

Type: Fixed price We need an independent penetration test of a small production environment. The report will be submitted to enterprise third-party risk teams, so report quality and the retest matter as much as the testing itself. Scope: One public IP on AWS External network testing on that host Authenticated grey-box testing of the web application and its API. We provide credentials for each role, architecture documentation and an asset inventory so you are not billing for reconnaissance Out of scope: internal network, social engineering, source code review, cloud configuration review This is a deliberately small scope. We are buying manual application testing depth, not IP count. Please quote tester-days rather than pricing it as a trivial job. Required in the base price: Draft report review window, with our written management response included in the final report Remediation retest after we fix findings, with a written retest confirmation stating which findings are closed Both the full technical report and a standalone executive summary suitable for a third-party risk file Report to state scope, methodology, test window, tester certification, findings with severity ratings and evidence, and remediation guidance. We expect OWASP or PTES methodology, or equivalent recognised guidance Timeline: engagement this week, testing the following week, initial report within two weeks of engagement, retest within one week of us confirming remediation. Please say so upfront if that is not achievable. Required: OSCP, CREST or GPEN certified tester performing the work Prior reports accepted by large enterprise or Big Four vendor risk assessments Professional liability or errors and omissions cover, or the ability to explain how you handle that Please attach a redacted sample report and a redacted sample retest letter. Proposals without a sample report will not be considered.