Information Security Projects on Upwork

I am seeking an experienced mobile forensics and cybersecurity specialist to perform a thorough security assessment of an iPhone to determine if it has been compromised, infected with spyware, or unauthorized monitoring tools.

Our company has 13 emails to be moved from Go Daddy to Microsoft.
I have purchased Microsoft licences to move our emails to.

We need support archiving emails and a smooth transition.

The experimental part of this thesis involves setting up a virtual NSA 5G cybersecurity laboratory, simulating controlled cyberattacks, and evaluating intrusion-detection systems and machine-learning models. The task must cover framework architecture, threat modelling, risk scoring, detection architecture, mitigation, and security assurance.

We need a Senior Platform Engineer for a long-term, full-time engagement (ASAP) to cover for a permanent team member. The role is security-focused.

Rate: up to €25/hour.

Location: candidates must be in EU countries, Balkans, CIS, or Ukraine.

Must be able to work on British time zone.

Payment period: 30–40 days.

Detailed requirements are under NDA — we will share them after initial screening.

IMPORTANT: Mandatory video calls are required. It is not possible to work around this. Daily stand-ups on everything are expected.

Please apply only if you have a Senior Platform Engineer profile (security-focused) and can send today ASAP your profile/CV. CV should be revised/reworked with clear client projects related to Senior Platform Engineering and security-focused work.

Please answer in your proposal:
1. Level of English (B2, C1, C2…)?
2. Number of years of experience as Senior Platform Engineer?
3. Location / country?
4. Citizenship?
5. Can you work on British time zone? (Yes/No)
6. Available date to join / start date?
7. Full-time mission OK? (Yes/No)
8. Do you have a CV revised with clear client projects related to Senior Platform Engineering and security-focused work?

We are a UK software company running a multi-tenant SaaS workflow platform for public-sector customers. We are looking for an experienced penetration tester to carry out a grey-box security test and provide a customer-ready report.

What we need tested

Web application and API (OWASP Top 10 and OWASP API Top 10)
Tenant isolation: cross-tenant data access, privilege escalation, role abuse
Authentication and session handling (Cognito/OIDC, MFA)
File upload and malware-scanning flows
A sandboxed workflow runtime (Node-RED)
Read-only review of our AWS configuration

Environment: AWS (London), Next.js and Fastify. We will provide test tenants, test accounts for each role, and a written scope and rules of engagement under NDA.

Deliverables

Report with an executive summary and CVSS-rated findings, with reproduction steps and remediation advice
A debrief call
A retest of Critical and High findings
A short statement of testing carried out

Required

Current CREST certification (CRT or higher) and OSCP/OSWE or equivalent. Certificate numbers will be verified.
A redacted sample report from a web or API test
Professional indemnity insurance
Willingness to sign an NDA, a data-processing agreement and an authorisation letter
UK/EEA data handling; evidence deleted within 90 days of the final report
Experience testing multi-tenant SaaS and AWS-hosted applications

Please include in your proposal: your testing method, the number of days you estimate, what the retest covers, and your availability in the next 4–6 weeks.

DESCRIPTION
We're a single dental practice in Michigan that built its own internal staff app. Before it starts handling real patient data in early November, we want an independent security engineer to review it, then retest what we fix.

The system:
• Web app: Next.js / TypeScript on AWS ECS Fargate behind an ALB and AWS WAF; staff sign in through Amazon Cognito (OIDC with PKCE, authenticator-app MFA)
• Data: PostgreSQL on Amazon RDS in isolated subnets, KMS encryption, Secrets Manager
• An LLM feature (Claude on Amazon Bedrock) that writes summaries and draft staff texts from database results. We want it tested for prompt injection through synced data
• Data in and out: a third-party practice-management sync (NexHealth), CSV uploads, and email through Amazon SES (links only)
• Infrastructure as code (AWS CDK), deployed by GitHub Actions through OIDC
• Already in place: GuardDuty, Security Hub, AWS Config, Inspector, Access Analyzer, CloudTrail. An automated review has already been done, and its fixes are merged

In scope:
1. The web app: authentication, session handling, role-based access across 4 staff roles, file uploads, token links, a TV kiosk pairing flow, CSRF, headers and CSP
2. The AWS account (read-only access): IAM, network, encryption, logging, alerting
3. The LLM feature: prompt injection and output guardrails
4. The data sync, uploads and email
5. The build and deploy pipeline (GitHub Actions, dependencies, container image)

Out of scope: AWS's and the vendors' own systems, our office network, phishing or social engineering, and denial-of-service or load testing.

What we provide: test accounts for each role on a synthetic test practice, a read-only AWS audit role, read access to the private code repository, and architecture docs.

What we need back:
• Findings ranked by severity, each with steps to reproduce and a recommended fix
• Any Critical or High finding reported the same day it's found
• A one-page summary we can use for our HIPAA risk analysis
• A retest of every Critical and High fix, within 2 weeks of the report

Requirements:
• Hands-on experience with AWS and web-app penetration testing, ideally healthcare SaaS under HIPAA
• OSCP, OSWE, AWS Security Specialty or similar
• Willing to sign a Business Associate Agreement and an NDA before any access is given
• Never copies or keeps patient data; findings are reproduced on the synthetic test practice
• US-based preferred

Timeline: contract, BAA and NDA signed within 1–2 days of hire; then about 3–5 working days of testing; the report; and a retest within 2 weeks.

The detailed scope and rules of engagement are shared with shortlisted candidates after they sign an NDA.


SKILLS
Penetration Testing, AWS Security, Web Application Security, HIPAA, Cloud Security, OWASP, Security Assessment

I'm looking for an experienced Network Engineer or Cybersecurity professional to deliver a 3-month training program covering networking and network security fundamentals. My goal is to be job-ready and interview-ready for real IT and cybersecurity roles, so I need clear, step-by-step explanations of every concept — not just what a technology is, but how it works, why it's used, and how to apply it on the job. The program should cover networking essentials (OSI/TCP-IP models, protocols, IP addressing, subnetting, routing, switching, DNS, DHCP), security fundamentals (firewalls, VPNs, IDS/IPS, NAT, common attacks and defenses), and practical skills including essential commands, troubleshooting techniques, and hands-on labs using tools like Packet Tracer, Wireshark, and Nmap. I also want real workplace scenarios woven in — such as handling "network down" tickets, securing wireless networks, and explaining technical issues to non-technical stakeholders — plus mock interview questions to prepare me for technical interviews. The ideal candidate has current real-world experience (not just textbook knowledge), strong communication skills, and the ability to provide a structured syllabus for the 12 weeks. To apply, please share a brief outline of how you'd structure the program, your relevant experience, your rate (hourly or fixed for 3 months), and your availability for a quick intro call.

I'm an aspiring SOC analyst looking for an experienced SOC professional to provide hands-on mentorship. I need help with alert triage using SIEM tools (Splunk/Elastic), phishing analysis, log interpretation, home lab setup, and resume/interview prep for Tier 1 roles. Ideal candidates have real production SOC experience and familiarity with tools like Splunk, Sentinel, or CrowdStrike. This is a part-time engagement (3–5 hrs/week) for 1–2 months. In your proposal, include a brief 4-week training outline, your SOC background and tools used, and your hourly rate

Hi, I'm looking to work with an experienced mobile cybersecurity specialist to learn about Android and iOS security, mobile spyware, and remote-access technologies.

I'm interested in understanding how image-based exploits work, how spyware infects mobile devices, how remote-access tools are developed, and how security professionals identify and prevent unauthorized access.

I'm looking for someone who can provide hands-on training in a controlled testing environment using devices I own or have explicit permission to test.

Could you please share your experience, the training you offer, the tools and technologies involved, and your estimated cost?

Thank you.

I am seeking a qualified and trustworthy ethical hacker to conduct an authorized security assessment of a wireless electronic device to identify potential security vulnerabilities, unauthorized access, suspicious software, spyware, malware, unauthorized monitoring, or other indicators of compromise.

Hi, I'm looking to work with an experienced mobile cybersecurity specialist to learn about Android and iOS security, mobile spyware, and remote-access technologies.

I'm interested in understanding how image-based exploits work, how spyware infects mobile devices, how remote-access tools are developed, and how security professionals identify and prevent unauthorized access.

I'm looking for someone who can provide hands-on training in a controlled testing environment using devices I own or have explicit permission to test.

Could you please share your experience, the training you offer, the tools and technologies involved, and your estimated cost?

Thank you.

I own Fit Code, a strength and conditioning gym with two Chicago locations. I have a working front-end prototype of a member nutrition app and need a developer to build the real backend and ship it as a small pilot for about 10 to 30 members.

What exists today: A single-page prototype (HTML/JS, attached) with a macro calculator, meal logging by ounces or hand portions, an AI meal plan generator, and a dashboard. All data is stored in the browser, so nothing persists across devices and there are no accounts.

What I need built (Phase 1):

Member accounts with Supabase Auth (email and password, plus password reset). Google sign-in is a bonus.
Postgres database for macro plans, meal plans, meal logs, and daily logs (weight, water). Row-level security so a member can only ever see their own data.

One summary view in the database that I can review directly in the Supabase dashboard, with one row per member: name, days since last log, current logging streak, average protein vs. target for the past 7 days, and latest weight. No custom admin page in Phase 1. Please build the user table with a role column (member, admin) so an admin page can be added later without rework.
AI calls moved to the server. Meal plan generation and macro estimates run in Supabase Edge Functions or Vercel serverless functions. The Anthropic API key must never reach the browser. Add per-member daily usage limits so one person cannot run up my bill.

Deployed on Vercel as an installable web app (PWA) that works well on iPhone and Android home screens.
Account deletion and data export for members.

Out of scope for Phase 1: native App Store apps, payments, MindBody or Arketa integrations, photo meal analysis, a custom admin or coach page.

Phase 2 (only if Phase 1 goes well): an admin page, push or email reminders, integrations with our member systems.

You should have:

Shipped production apps on Supabase (not just tutorials), including RLS policies you wrote yourself
Experience with Vercel deployments and environment variables

Experience calling LLM APIs from a backend
Comfort working from an existing prototype instead of rewriting it from scratch

Clear written English and a short weekly check-in

Ownership terms: All code lives in a GitHub repo I own. Supabase and Vercel accounts are created under my email, and you are added as a collaborator. You will not hold the only copy of any credential. Final deliverable includes a short README so another developer can pick it up.

Data note: The app stores member weight and health information. Security is not optional here, and I will ask you to explain your RLS setup before I release the final milestone.

To apply, answer these in your first message (proposals without them will be skipped):

1. Link to one live app you built with Supabase and tell me which part you wrote.

2. How would you structure row-level security so members cannot see each other’s data, while an admin role can read everything?
3. How would you stop one member from running up my AI bill?
4. What would you cut or change in the prototype before building on it?

5. Does Supabase’s current plan offer read-only team access, and how would you set me up to view data safely?

Budget: Give me what you think this would cost to build out.

Accounts and database live
Member features working against the database
Summary view, AI usage limits, and deployment

I release each milestone only after testing it on my own phone. Open to your estimate if you can justify it.

Timeline: 3 to 5 weeks.

30-day bug-fix window after launch is expected.

fit-code-nutrition.html

Oakshield (oakshield.co) verifies whether small businesses' PHP and WordPress servers are actually patched for recent critical PHP vulnerabilities, and whether there are signs of compromise. Oakshield is a business of Luven Technologies LLC, a new US firm. Our tools collect read-only evidence and a rule engine decides pass/fail. A named person approves every report. We need a senior engineer as an independent reviewer.

The work: you review evidence bundles (process lists, package versions and changelogs, PHP-FPM and php.ini settings, file hashes, cron and user lists). You confirm or challenge our draft findings, and approve or escalate. No access to client systems, ever. About 1–2 hours per job, booked in advance with an agreed response time. To start: our first 10 jobs per service, plus any job with a possible sign of compromise or an online store.

You have:
- 5+ years running production PHP (PHP-FPM, Apache/mod_php, nginx) on Linux
- Real familiarity with distro and vendor backports (Debian/Ubuntu, RHEL/Alma, cPanel, CloudLinux, Plesk)
- WordPress/WooCommerce experience
- Incident-response judgment ("stop, preserve evidence, escalate")
- Clear writing

Terms: hourly (tell us your rate), no minimum, per booked job. Paid trial first: 2–3 hours reviewing three test servers. Before you see any real client data, we require a short NDA and contractor terms (confidentiality, IP, data handling) and a background check. Professional liability (E&O) insurance is required within 30 days. US-based preferred. Individuals only, no agencies.

To apply, answer:
1. Which weekday and evening hours (time zone) could you cover?
2. In 3–6 sentences: how do you confirm a PHP fix is actually running on a Debian or RHEL server whose package keeps an old version number?
3. Does any current employment or contract restrict outside work or claim IP you create?

We manage vacation rentals, and some guests are receiving phishing messages impersonating our business or booking communications. We suspect a security incident, but the source and extent have not been confirmed.

We need an experienced, hands-on incident-response specialist who can start promptly, trace the source, stop unauthorized access, and help fix confirmed security gaps.

INITIAL PHASE: $500 FIXED PRICE
This budget is for a focused initial investigation and agreed containment/hardening work. In your proposal, clearly state what you can complete within $500, the deliverables, and the expected timeline. Any broader remediation or testing must be quoted and approved separately before proceeding.

SCOPE
- Review supplied phishing-message samples, headers where available, timestamps, and relevant account, messaging, and integration logs; preserve useful evidence.
- Determine whether the evidence points to account takeover, sender impersonation, exposed guest data, a compromised integration, or another cause. Separate confirmed findings from hypotheses.
- Review relevant authorized business-email, booking-platform/PMS, and connected messaging accounts. Assess suspicious sessions, staff access, third-party app permissions, API tokens, MFA/recovery settings, forwarding rules, and delegated access as applicable.
- Perform agreed containment and targeted fixes while coordinating production changes to avoid disrupting legitimate guest communications.
- Verify the implemented changes and explain what was tested and what remains unresolved.

DELIVERABLES
1. Plain-English findings with supporting evidence and an incident timeline where available.
2. Systems/accounts and guest data potentially affected, with confidence and limitations clearly stated.
3. A record of containment and fixes actually implemented, plus verification results.
4. A prioritized list of remaining risks and a separate estimate for any additional work.

EXPERIENCE
Please demonstrate experience investigating real account compromises and SaaS/email incidents. Experience with Google Workspace, booking platforms, OwnerRez, and messaging integrations is useful. Certifications are welcome, but practical incident-response experience and clear communication matter most.

ACCESS AND CONFIDENTIALITY
Work is limited to systems we own or explicitly authorize. Start with supplied evidence/read-only access where practical, use temporary access as needed, protect guest information, and preserve evidence. Coordinate disruptive changes in advance. No destructive testing or testing of third-party platforms without authorization.

PLEASE INCLUDE
- Earliest start time, timezone, and availability for an initial call through Upwork.
- One or two comparable incidents you handled, without revealing client information.
- Your first investigation steps and the specific work/deliverables included in the $500 phase.
- A redacted sample report, if available.

Please keep proposals and communications on Upwork. We will share sensitive evidence privately with the selected specialist.

The job is regarding a website which is basically a platform where all sorts of procurement through government officials is happening. It's a website just like Amazon, Flipkart etc where a buyer search for his desired product and purchase it, but in here the buyer is a Government employee or institution. We want someone who can help the sellers in their work in the website.

We are seeking a Security Operations Center Analyst to triage security alerts generated from our SIEM (Sentinel).
Triage alerts as false positives or react to true positives by resetting user passwords or isolating computer accounts in Microsoft Defender for Endpoint.
Escalate incidents to customers using our Service Desk Software.

The technologies that the person will be working with include Microsoft Sentinel, the entire suite of Microsoft 365 Defender products, and potentially Microsoft Defender for Cloud.

Candidates for this role should be familiar with attack vectors, cyberthreats, incident management, and Kusto Query Language (KQL).

Must Have:
Prior experience working in a Security Operating Center
Above Average English Language - Verbal and Written
A laptop with a fast and stable Internet Connection


Nice to Have:
Security Certifications: SC-200, AZ-500

We are hiring for the following (Weekend) shifts, as well as the opportunity for a floating analyst:

1st Shift (12 AM PST to 8 AM PST)

We are a UK-based translation company seeking an experienced IT consultant to help us move from an on-site data server to a secure, affordable cloud solution.

We have approximately 5 TB of data to migrate, including translation files, client materials, and company records. We currently use Google Workspace Business Starter for email and communication, and we are open to Google Drive or alternative cloud platforms if they offer better value, security, or suitability for a small business.

We hold ISO 27001 certification and need to ensure the migration and new setup continue to meet our information-security requirements.

Scope of work
- Review our current server, data structure, storage needs, and user access requirements.

- Recommend the most cost-effective cloud solution for a small business, comparing Google Drive, Microsoft 365/OneDrive/SharePoint, Dropbox, Box, or other suitable options.

- Provide a clear cost breakdown, including storage, licences, backup, migration, and ongoing support.

- Plan and manage the secure migration of approximately 5 TB of data.

- Set up folder structure, permissions, user access, sharing controls, and testing.

- Ensure secure backup and verification before decommissioning the server.

- Advise on secure disposal or sanitisation of the existing server and storage media, with appropriate documentation or certificates where required.

- Review basic ISO 27001-related controls, including access management, data retention, secure deletion, backups, cloud-provider risk, and documentation.

- Provide user guidance, handover documentation, and short-term post-migration support.

Requirements
- Proven experience migrating small businesses from on-premises servers to cloud storage.

- Strong knowledge of Google Workspace and/or Microsoft 365.

- Understanding of UK/EU data-protection requirements and ISO 27001 controls.

- Experience with secure data disposal and verifiable data erasure.

- Ability to explain technical options clearly and recommend a practical, budget-conscious solution.

- UK-based preferred; remote support acceptable, with on-site work only if necessary.

To apply
Please include:

- Relevant experience and examples of similar migrations.

- Your proposed approach and estimated timeline.

- Pricing structure: fixed fee, day rate, or phased proposal.

- Any ongoing support options.

This is initially a project-based engagement, with the possibility of ongoing IT support if it works well.

- Complete the remaining service pages (approx. 7-10 service pages for dental services) build-out
- Connect SEO tools to the existing websites (google AdSense, rankSEO)
- Update 'Our Doctors Page' with additional providers
- Make website ADA compliant
- Make further formatting changes as needed during QC/QA

Priority to change based on business need.

Job Title: CaseWare Implementation & Data Migration Specialist (External Contractor)

Engagement Type: External Contractor / Freelance
Project-Based Assignment

Job Summary

We are looking for an experienced CaseWare specialist to support the implementation, setup, configuration, and data migration of our CaseWare system, ensuring that both historical and current client data are accurately uploaded, organized, and maintained.

Key Responsibilities

* Set up and configure the CaseWare software according to the company’s requirements.
* Review, organize, and prepare existing client data for migration.
* Upload and migrate historical client data into CaseWare.
* Create and maintain client records for new clients.
* Verify the accuracy, completeness, and consistency of migrated data.
* Identify and resolve data migration issues and discrepancies.
* Coordinate with the company’s team to ensure the system meets operational requirements.
* Provide basic user guidance and handover documentation upon project completion.
* Maintain strict confidentiality and security of all client information.

Required Qualifications

* Proven hands-on experience with CaseWare implementation and configuration.
* Previous experience in client data migration and system setup.
* Strong data management, organization, and validation skills.
* Experience working with Excel and importing/exporting structured data.
* Excellent attention to detail and problem-solving skills.
* Ability to work independently and meet agreed project deadlines.
* Strong understanding of data confidentiality and information security.

Engagement Details

* External, project-based engagement.
* Scope of work and deliverables to be agreed upon before commencement.
* Expected start date and project duration to be agreed.
* Candidates should provide a brief summary of relevant CaseWare projects and experience.

AI-native Python developer, strong on infrastructure (Claude, MCP, ecom)

We're ecomAIOS, a small Australian team based in Bali that builds AI systems for ecommerce founders. We find where a brand is losing money, fix it, then keep running and improving the system for them every month. We have five clients so far and more coming, and we need one developer to grow with us.

This isn't a "here's the spec, build it" role. I want someone I can hand a problem to who comes back with the best way to solve it, builds it, and tells me what I missed.

What you'd work on
- Hosting and onboarding: run our client apps safely, and get a new client's Shopify, Meta, Google and Xero connected and live in a day.
- A standard dashboard app we copy for each client. It pulls daily from Shopify, Meta Ads, Google Ads, GA4, Klaviyo and Xero.
- A Claude connector (MCP), so a founder can ask their own Claude about their business and send tasks to their team.
- Turning our 7-day money-leak diagnosis into an automation. It's about 38 checks today, and most of them run by hand.
- Keeping live client apps healthy and building the small things clients ask for.

Our stack: Python, Flask, SQLite, Anthropic API, GitHub. Hosting is yours to own and recommend.

Must have
- You've hosted and run production apps yourself: deployment, secrets, backups, monitoring
- You can keep clients fully separate: one client's keys and data can never reach another's
- You can read and fix Python without Claude Code. You will be tested live on this.
- You use Claude Code (or similar) every day and build fast with it
- 2+ years of development for ecommerce brands (Shopify, Meta Ads or Google Ads data)

You'll also be a good fit if you
- Have a marketing background
- Have shipped Python web apps that real people use
- Want steady, ongoing work with one team, not ten random gigs

How it works
- Contractor, paid per client project, with a steady flow of work as we grow
- Exclusive to us once we're both sure it's a fit
- We start with one small paid trial job, capped hours
- Strong preference for someone in Bali who can work alongside us a couple of days a week. Otherwise remote, with overlap on Bali / Australian hours

To apply
Start your reply with the word "LEAK" so I know you read this. Then in five sentences or fewer, tell me how you'd host our client apps so a new client is live in a day and one client's data can never reach another's. Add a link to something you've built.

Harry, ecomAIOS

Robert James Trial Attorneys is a U.S.-based law firm providing criminal defense and personal injury representation. We are seeking a legally trained professional based in Latin America ideally an attorney or law graduate who wants to apply their legal education and experience in a remote paralegal role supporting our Georgia personal injury litigation practice.

This role supports the Personal Injury Litigation Attorney with case management, discovery, filings, medical records, liens, settlement preparation, client communication, and administrative tasks. The ideal candidate is proactive, detail-oriented, fluent in professional English, and able to manage routine case needs while escalating legal decisions to U.S.-licensed counsel.

Position Details
- Location: Remote; candidates in Mexico and other Latin American countries encouraged to apply.
- Schedule: Full-time, 9:00 a.m.–5:00 p.m. U.S. Eastern Time.
- Compensation: $10–$12 USD per hour, depending on qualifications and experience; final terms to be confirmed.
- Role: Paralegal/legal support position, not a U.S. attorney position.

Key Responsibilities

Litigation & Case Management
- Assist with pleadings, discovery, correspondence, court filings, and service of process.
- Track open records requests, affidavits of service, court deadlines, and case calendars.
- Monitor cases, identify outstanding tasks, and escalate issues requiring attorney attention.

Medical Records & Documentation
- Request, organize, and track medical records and billing statements.
- Follow up with providers and prepare medical treatment and billing summaries.
- Identify missing documentation and maintain complete case files.

Liens & Settlement Support
- Conduct lien lookups and coordinate Medicaid requests.
- Track medical liens, balances, and settlement obligations.
- Prepare settlement distribution statements and closing documents for attorney review.

Client Communication & Administration
- Communicate with clients, providers, insurers, opposing offices, process servers, and government agencies.
- Draft routine correspondence and follow up on outstanding documents and requests.
- Maintain electronic files, case notes, calendars, and expense records.
- Assist with filings, service fees, incoming correspondence, and other case-related administrative tasks.

Required Qualifications
- Law degree from a recognized university in Mexico or another Latin American country; licensed attorneys are encouraged to apply.
- Advanced written and spoken English proficiency.
- Strong legal research, drafting, organization, document review, and deadline-management skills.
- Ability to manage multiple cases independently and provide accurate status updates.
- Reliable internet, a private workspace, and commitment to confidentiality and information security.

Preferred Experience
- Experience with a U.S. law firm, personal injury litigation, or civil litigation.
- Knowledge of discovery, pleadings, court filings, service of process, and litigation calendars; Georgia procedure experience is a plus.
- Experience with medical records, billing, liens, and settlement documentation.
- Familiarity with MyCase or similar case-management software.

Role Expectations & Professional Boundaries
The candidate must proactively manage assigned tasks, track deadlines, follow up on pending requests, maintain organized files, and flag issues requiring attorney review.

All work will be performed under attorney supervision. This position does not authorize independent U.S. legal advice, attorney representation, legal strategy decisions, or unsupervised legal practice. Substantive legal questions and settlement advice must be referred to the assigned attorney.

Success in This Role
Success is measured by accurate case files, timely assignments, reliable calendaring, consistent follow-up, professional communication, accurate documentation, and proactive litigation support.

How to Apply
Submit an English-language CV detailing your legal education, bar admission or professional credentials (if applicable), English proficiency, and relevant litigation or U.S. law firm experience. Shortlisted candidates may be asked to complete a written English and legal-support skills assessment.

About the engagement

We want an independent penetration test of our multi-tenant SaaS platform, with results we can share with customers during their security due diligence.
The platform runs AI agents that answer phone calls, website chat, WhatsApp and SMS for business customers. Each customer is a tenant, and each tenant has one or more branches. It processes personal data, including contact records, call recordings and transcripts.
Our priority is proof that no tenant, branch or outside party can see or change another's data, including by talking to our AI agents.

The platform and what's in scope

All five components below are in scope.
• Web application and admin panel (PHP / Laravel), behind login
• REST API (PHP / Laravel), by API token
• Website chat widget: AI agent, public, no login
• WhatsApp and SMS agents: AI agent, public, reached by messaging our numbers
• Voice AI service (Python / FastAPI): live phone calls, public, reached by calling our numbers
Hosting is serverless on AWS with an Aurora MySQL database. Sign-in uses email and password with MFA (authenticator app or email code), plus Microsoft single sign-on.

What we want tested

Four areas, in priority order.
1. Tenant isolation and authorisation
◦ Cross-tenant access to records and settings through the web app, API and admin panel: conversations, recordings, transcripts, contacts, configuration
◦ Branch scoping inside a tenant: staff limited to one branch must not reach another branch's data
◦ Role escalation across our three user roles, at both object and function level
◦ Leaks through exports, reports, dashboards, search and file downloads
2. Authentication and sessions
◦ Login, password reset, MFA enrolment and bypass, Microsoft SSO account linking
◦ Session handling, API token scope and revocation
◦ Standard OWASP checks (injection, XSS, CSRF) on the in-scope screens and endpoints
3. Public AI chat channels: website chat, WhatsApp, SMS
◦ Direct and indirect prompt injection
◦ Disclosure of system prompts, other customers' data or another tenant's data
◦ Aligned to the OWASP Top 10 for LLM Applications
4. Voice AI: phone calls
◦ Prompt injection and manipulation by voice
◦ Bypassing caller identity checks
◦ Calls go to staging numbers we provide, within an agreed call budget

How testing works

Testing is grey-box: you get accounts and documentation, but no source code. We'd rather your days go on finding issues than on mapping the app.

We provide:

• A staging environment in its own AWS account, mirroring production, with synthetic data only (no real personal data)
• Two tenants, each with two branches, and accounts for every role in both
• An API endpoint list and a role and permission matrix
• Staging phone, WhatsApp and SMS numbers, and the staging chat widget
• Agreed caps on AI and call usage for the test window
• IP allow-listing for your source addresses, and a named escalation contact

Who we're looking for

We prefer a CREST-accredited company. CREST-certified testers at a company that isn't accredited can also apply. Say clearly which one you are.
• CREST-accredited company: send your listing on the CREST Marketplace. The attestation letter must say "Performed by [your company], a CREST-accredited member company".
• CREST-certified testers at a company that isn't accredited: tell us the CREST certification each named tester holds (CRT, CCT APP or equivalent). The attestation letter must say "Performed by a CREST Registered Penetration Tester (CRT)", or the certification actually held.
Accreditation applies to companies and certification to people. Claiming accreditation you don't hold rules your proposal out, and we check the Marketplace.

We also need:

• Proven experience testing authorisation in multi-tenant SaaS
• Hands-on LLM and prompt-injection testing; voice or telephony AI experience is a plus
• The named testers do the work, with no subcontracting unless we agree in writing

Deliverables

The attestation letter matters most to us, because our customers will read it.
• Technical report: executive summary, methodology, what was and wasn't tested, CVSS v3.1-scored findings with evidence and reproduction steps, and remediation advice
• Attestation letter: names our company (the legal entity, not an individual), the scope, the test dates and tester credentials worded as set out above. We approve the wording before it's issued.
• Redacted executive summary we can share with customers under NDA
• Critical findings reported to us the same working day
• One retest of all findings within 60 days of the report, with a retest report

Commercial and legal terms

We need a fixed price and clear rules on handling our data.
• Fixed price, with the retest included
• A signed testing authorisation (scope, dates, source IPs) before any testing starts
• Our NDA and Data Processing Agreement signed before you get access
• All test data and evidence destroyed when the engagement closes, confirmed in writing

What your proposal must include

1. Your CREST status, with proof
2. Named testers and their relevant experience (multi-tenant SaaS, LLM testing)
3. Elapsed time from start to final report, and your earliest start date
4. How you'll test the AI channels, including the expected number of test calls and messages
5. Fixed price and payment terms
6. A redacted sample report and a sample attestation letter

We are looking for an experienced ISO/IEC 27001:2022 professional to conduct an internal ISMS audit and assess our organization's compliance with the standard.
Scope of Work

- Review existing ISMS documentation, policies, procedures, and records.
- Assess compliance with ISO/IEC 27001:2022 requirements.
- Evaluate information security controls, risk assessments, the Risk Treatment Plan, and Statement of Applicability (SoA).
- Identify compliance gaps, nonconformities, and areas for improvement.
- Develop an audit checklist and document findings based on objective evidence.
- Prepare a comprehensive internal audit report with recommendations.
- Provide a corrective action register and follow-up recommendations.

### Required Qualifications

- Practical experience with ISO/IEC 27001:2022 and ISMS requirements.
- Experience conducting internal ISMS audits and assessing information security controls.
- Knowledge of ISO 19011 auditing guidelines and risk management.
- Strong analytical, documentation, and reporting skills.
- ISO/IEC 27001 Lead Auditor or Internal Auditor certification is preferred.

### Expected Deliverables

- Internal audit checklist
- Completed audit findings and evidence
- Internal ISMS audit report
- Nonconformity and corrective action register
- Recommendations for addressing identified gaps

### To Apply

Please share your relevant ISO 27001 auditing experience, certifications, and examples of similar projects you have completed.

In your proposal, briefly explain your approach to conducting an ISO/IEC 27001:2022 internal ISMS audit.

Data Protection Officer (DPO) / Data Privacy Consultant

Project Overview:
We are looking for a Data Protection Officer or Data Privacy Consultant to help maintain privacy compliance and improve our data protection practices.

Responsibilities
-Review privacy policies and data protection documentation.
-Identify compliance gaps and privacy risks.
-Assist with privacy policies, procedures, and risk assessments.
-Support data handling, consent management, and data retention practices.
-Maintain compliance records and recommend improvements.

Requirements:
-Experience in data protection, privacy, or compliance.
-Knowledge of relevant data protection laws and regulations.
-Strong documentation and communication skills.
-Relevant privacy certifications are an advantage.

How to Apply:
Please share your relevant experience, examples of similar work, availability for the next three months, and confirmation that you accept the $8/hour rate.

We look forward to connecting with a suitable professional.

Urgent requirement for Pentest for a B2B SaaS platform.

We have a client who are looking to have Microsoft Intune implemented and setup across their tenant. The tenant consists of 7-8 users but prior to them onboarding and main point of contact was self-managing with no IT experience resulting in multiple other unused email accounts and user mailboxes acting as shared mailboxes.

Our team has already purchased the correct licenses required for Intune alongside upgrading their laptops to 16GB and Windows 11 PRO.

Being that we're still a growing company Myself and the other Directors understand Intune but do not have the adequate time to implement. We're anticipating 4-6hrs of work to complete.

Patch Cap is seeking an experienced IT systems and endpoint-security professional to configure two new Windows laptops before they are issued to members of our team.

Patch Cap operates in financial services and handles commercially sensitive, financial and compliance-related information. The laptops must therefore be configured as centrally managed company devices rather than ordinary consumer computers.

The initial project covers two Windows laptops, likely manufactured by Dell or another established business-laptop provider. The devices will ultimately be used internationally. The selected consultant may configure the laptops remotely while they remain in Patch Cap’s custody, or Patch Cap may ship the laptops to a properly vetted consultant for secure physical configuration and return shipment. Applicants should explain their recommended approach, including any chain-of-custody, shipping, insurance and device-security requirements.

We use Google Workspace for company email, identity and document collaboration. Our preferred endpoint architecture is Microsoft Intune with Microsoft Defender for Business, integrated appropriately with our Google Workspace environment. We are open to a comparable recommendation if the consultant can explain why it would provide better security, administration and scalability.

Scope of Work
The consultant will be expected to:
1. Recommend and Configure the Management Architecture
- Review our requirements and recommend the appropriate licensing and technical architecture.
- Configure Microsoft Intune and Microsoft Defender for Business, or another approved endpoint-management solution.
- Ensure that all tenants, subscriptions, administrative accounts and licenses are established in Patch Cap’s name and under Patch Cap-controlled email addresses.
- Integrate the endpoint-management environment appropriately with Google Workspace.
- Configure Google Endpoint Verification and managed Chrome policies where appropriate.
2. Enroll and Configure the Laptops
- Install or verify a clean and current version of Windows 11 Pro.
- Install all operating-system, driver, BIOS, firmware and security updates.
- Enroll both laptops as company-owned devices in the selected management platform.
- Configure each laptop for its assigned Patch Cap user.
- Create standard user accounts without routine local-administrator privileges.
- Create a separate company-controlled administrator account for maintenance and recovery.
- Disable guest accounts and unnecessary default services.
3. Apply Security Controls
- Enable and verify BitLocker full-disk encryption.
- Store BitLocker recovery keys securely within a Patch Cap-controlled management platform.
- Enable Secure Boot, TPM and other supported hardware-security features.
- Configure Microsoft Defender for Business or an approved equivalent.
- Enable firewall, malware, ransomware and web-threat protections.
- Configure automatic operating-system and application updates.
- Establish password, PIN and automatic screen-lock requirements.
- Require multifactor authentication for company systems.
- Restrict or monitor removable storage and USB devices as appropriate.
- Restrict unauthorized software installation.
- Prevent the use of personal cloud-storage services for Patch Cap information.
- Configure remote lock, device retirement and remote-wipe capabilities.
- Ensure the management and security software cannot be removed by an ordinary user.
4. Install and Configure Approved Applications
Applications are expected to include:
- Google Chrome with centrally managed policies;
- Google Drive for Desktop;
- Google Workspace access;
- Google Meet and/or Zoom;
- an approved office-productivity suite;
- approved PDF software;
- a company password manager;
- Microsoft Defender or another approved endpoint-security application; and
- approved remote-support software.
The consultant should recommend any additional applications required for secure operation without installing unnecessary software.
5. Configure Data Protection and Access
- Ensure company documents are stored in approved Google Drive locations rather than only on the local device.
- Configure appropriate Google Workspace access controls and device verification.
- Apply access based on each user’s role.
- Establish a process for removing company data and access when a worker leaves Patch Cap.
- Confirm that Patch Cap can disable access and remotely secure or erase a lost or stolen laptop.
6. Asset Management and Documentation
Create and deliver:
- an asset register containing the manufacturer, model, serial number, assigned user, purchase date, warranty information and Patch Cap asset number for each laptop;
- a record of the security policies and configurations applied;
- an application inventory;
- confirmation of encryption, endpoint-protection and update status;
- an administrator and recovery-key register stored securely under Patch Cap’s control;
- a written onboarding procedure for future laptops;
- a written offboarding procedure for departing employees and consultants;
- a brief user guide covering login, MFA, password management, security incidents and technical support; and
- an administrator guide explaining how Patch Cap can monitor, lock, retire, reassign and wipe devices.
7. Testing and Handover
Before completion, the consultant must:
- confirm that both laptops appear in the management console;
- confirm that the required security policies have been applied;
- verify BitLocker encryption and recovery-key storage;
- verify endpoint-protection and firewall status;
- confirm application and update deployment;
- confirm that users do not have unauthorized administrator privileges;
- confirm that Patch Cap has remote lock and wipe capabilities;
- conduct an administrator handover session with Patch Cap;
- provide all configuration and recovery documentation; and
- remove or surrender all temporary access granted to the consultant.
The consultant must not retain Patch Cap credentials, recovery keys, device access or copies of company information following completion.
Access and Security Requirements
The selected consultant will be required to sign a confidentiality agreement before receiving administrative access.

Patch Cap will provide a dedicated, temporary administrative account with only the permissions required for the project. The consultant will not receive or use the personal credentials of Patch Cap executives, employees or consultants.

No management tenant, subscription, administrator account or recovery mechanism may be established under the freelancer’s personal or business email address. Patch Cap must remain the sole owner and ultimate administrator of the environment.

All project access must be documented and removed or reduced upon completion of the engagement.
Required Experience

Experience desired:
- Windows 11 Pro deployment and hardening;
- Microsoft Intune;
- Microsoft Entra ID;
- Microsoft Defender for Business or Defender for Endpoint;
- BitLocker deployment and recovery-key management;
- Windows device enrollment and compliance policies;
- Google Workspace administration;
- Google Endpoint Verification and managed Chrome;
- multifactor authentication;
- endpoint security and least-privilege administration;
- remote device support;
- employee onboarding and offboarding; and
- technical documentation for small or growing organizations.

Hi,

Our Meta Business Portfolio has been permanently restricted since March 2024, with our Facebook Page still owned by it.

Our personal account, Instagram and newer portfolio show no restrictions, but attempts to transfer the Page fail.

Meta Support advised that a manual Page release is required, yet numerous escalations and support cases have led nowhere.

Have you successfully handled similar cases, and could you assist with a legitimate manual release?

Many thanks.

We are seeking an experienced cybersecurity and IT auditor to conduct an independent security and infrastructure review of our travel technology platform. The engagement will focus on application security, authentication, API and third-party integrations, database and sensitive data handling, hosting and infrastructure configuration, dependencies, vulnerabilities, logging, monitoring, backup readiness, and production operational risks. This is a read-only, non-disruptive audit with no penetration testing, exploitation, production changes, or live transactions unless separately authorized. Please include relevant certifications, audit experience, methodology, estimated timeline, and a fixed-price proposal.

I would like to try to recover money I lost in an online false work involving Telegram tasks. The scam involved a website, where my balance was displayed, but it is currently locked.

Hi there! There’s a fake profile made with my profile picture with husband. The profile is spreading my personal stolen cctv footage and also spreading words of lies and misinformation also blackmail me to write more!