Optimize Network Security Projects on Upwork

I need an experienced network-security professional to conduct an in-depth threat analysis of our cloud infrastructure. The environment spans several AWS accounts with VPC peering, Transit Gateway routing, and a mix of Kubernetes clusters and serverless workloads.

Your job is to map likely attack vectors, evaluate existing controls, and clearly articulate the real-world risks we face. I will grant read-only access to relevant CloudTrail, GuardDuty, and VPC Flow Logs as well as diagrams of our current architecture. Feel free to weave in additional tooling such as Nmap, Nessus, Wireshark, Metasploit, or custom scripts—whatever produces the most accurate picture.

Deliverables
• Threat model highlighting assets, actors, and entry points
• Evidence-backed risk ratings with CVSS or a similar scoring method
• A mitigation roadmap ordered by impact and effort
• Executive summary (non-technical) plus a detailed technical report

Acceptance criteria: findings must be reproducible, each risk tied to a specific log, scan result, or configuration snapshot, and recommendations mapped to industry standards (NIST CSF or CIS Benchmarks).

Timetable is flexible within reason, but I would like the first draft of the threat model within one week of project start so we can iterate quickly. Let me know your relevant certifications, past cloud-focused engagements, and which toolset you prefer so I can streamline access on day one.

Skills: Linux, Computer Security, Cloud Computing, Cisco, Network Administration, Kubernetes, Cloud Security, Network Security

Join our team as a Security Engineer to enhance our AWS and application security. You'll work closely with our DevOps team to implement security best practices, conduct vulnerability assessments, and ensure compliance with security standards. This role requires a proactive approach to identifying and mitigating security risks.

• Describe your recent experience with similar projects

Hello,

My friend was the victim of a cyberattack about two months ago. It started when his Instagram account was compromised. While trying to determine what had happened, he discovered that several of his social media accounts, including WhatsApp, Snapchat, and Instagram, appeared to have been compromised and monitored.

While seeking assistance, his Upwork account was also unexpectedly blocked. Since then, his Android phone and WhatsApp have been behaving unusually. He has experienced suspicious activity involving his accounts, unauthorized access attempts, spam messages, and unknown WhatsApp contacts reaching out to him. It appears the attacker gained access to his contacts, emails, and one-time passwords (OTPs).

The attacker also enabled a third-party two-factor authentication service (Duo Security) on his Instagram account, preventing him from regaining access.

This has become an ongoing case of cyber harassment, and we are looking for help to secure his accounts and recover his Instagram account. We are seeking assistance from a reputable and legitimate cybersecurity professional or ethical hacker who specializes in incident response and account recovery.

Any guidance or assistance would be greatly appreciated.

We are seeking a highly skilled, discreet, and expert Cyber Security Specialist / Internal Systems Auditor to monitor platform integrity, investigate staff activities, and ensure strict compliance with company policies. The ideal candidate will operate quietly to identify system abuses, fraudulent activities, and policy violations.

Key Responsibilities
Audit & Investigation: Actively monitor and investigate the activities of all staff members (from new hires to 20+ year veterans).

Threat & Error Detection: Identify system errors, duplicate accounts, fake profiles, and malicious actors within the network.

Account Actions: Permanently block and suspend accounts involved in unauthorized activities, including casino/gambling operations, harmful political agendas, or toxic/aggressive behavior.

Asset Management: Freeze unauthorized accounts, mark balances as non-withdrawable, and securely route recovered company funds to the designated IBBL (Islami Bank Bangladesh PLC) account.

Reporting & Compliance: Compile comprehensive investigative reports. When necessary, file General Diaries (GD) or official reports with local police stations regarding illegal activities.

Client Retention: Discretely connect with the clients of suspended staff members and smoothly transition them to trusted employees.

Direct Reporting: Provide regular, confidential updates on findings directly to the owner via online or direct channels.

Shift & Working Hours
This role requires a dedicated, flexible schedule structured around specific rest periods:

Rest/Off Hours: 10:00 PM to 10:00 AM (Sleeping time), plus 2 hours for meals, 1 hour for rest, and 1 hour for standard breaks.

Working Hours: All remaining hours outside of the specified rest times are dedicated to active monitoring and duties.

Job Requirements & Qualifications
Experience: Proven experience in internet technologies, advanced programming, and network security.

Education: A strong background in the Sciences. A College Certificate/Diploma in a relevant technical field is required. (A D.Sc. / Doctor of Science is not required, but high-level technical capability is mandatory).

Attributes: High integrity, absolute discretion, and the ability to work covertly without disrupting daily operations.

A Quick Note on System Security & Legalities
When hiring for a role with this much power, keep these industry best practices in mind:

Legal Framework: Transferring account balances, blocking funds, and reporting to the police (via GD) must strictly follow Bangladesh’s digital security and financial laws to protect your business from legal liabilities.

Access Control: Do not give a new hire total control over your IBBL bank routing immediately. Use secure, automated payment gateways or multi-signature approvals so funds are transferred safely without relying on a single person's manual intervention.

Skills: Computer Security, Technical Writing, Compliance, Risk Management, Network Administration, Internet Security, Penetration Testing, Network Security, Fraud Detection, Risk Assessment

We are seeking a skilled freelancer to install and configure a CCTV system with networking capabilities. The project involves setting up a network switch and ensuring all cameras are connected and functioning properly. The ideal candidate will have experience in network security and administration, as well as Linux system administration. This is a part-time engagement with a short-term duration in nellore location, Andhra Pradesh

The Role
We are seeking an experienced Security Operations Center (SOC) professional and educator to lead our new SOC Analyst training program. This is a unique opportunity for an instructor who has already developed a comprehensive SOC Analyst curriculum and is looking for a platform to deliver it.

You will not be building a course from scratch for us; instead, you will bring your proven, pre-existing training materials, slide decks, and hands-on lab environments to train our students. Your goal is to take professionals from diverse backgrounds and equip them with the practical skills needed to pass interviews and excel as Tier 1/Tier 2 SOC Analysts.

Key Responsibilities
Curriculum Delivery: Utilize your pre-existing, turn-key SOC Analyst training content to instruct cohorts of career-transitioning students.

Hands-on Training: Lead students through practical exercises involving SIEMs (e.g., Splunk, Sentinel), EDR tools, packet analysis (Wireshark), and incident response workflows.

Content Maintenance: Ensure your proprietary curriculum remains up-to-date with the latest threat landscapes, attacker tactics (MITRE ATT&CK), and industry tooling.

Mentorship & Coaching: Provide guidance, feedback, and career advice to students who are navigating the transition into the cybersecurity field.

Assessment: Evaluate student performance through your established quizzes, practical labs, and capstone projects to ensure they are job-ready.

Required Qualifications
Pre-Existing Curriculum: You must have a fully developed SOC Analyst course ready for deployment, including syllabi, lecture materials, and practical lab exercises.

Industry Experience: Minimum of 3+ years of active experience working in a Security Operations Center as a Tier 2/Tier 3 Analyst, Incident Responder, or SOC Manager.

Teaching Experience: Proven track record of teaching, mentoring, or training individuals in cybersecurity concepts, specifically those with non-technical backgrounds.

Technical Proficiency: Deep understanding of network traffic analysis, log aggregation/correlation, phishing analysis, and malware triage.

Communication: Exceptional ability to break down highly technical and complex concepts into digestible, accessible lessons for beginners.

Project Description

We are looking for an experienced Sophos UTM / Sophos Firewall (SFOS) engineer to assist with the migration of a production Sophos UTM SG230 to a new Sophos Firewall XGS.

This is a production environment, so we are looking for someone who has completed real Sophos UTM to XGS migrations and is familiar with the Sophos Migration Assistant (CLI) as well as manual migration tasks.

A full UTM backup (.abf), configuration exports, and detailed documentation of the current environment will be provided.

Current Environment

The firewall currently includes:

Sophos UTM SG230
Approximately 100 firewall rules
NAT and Masquerading policies
12 Sophos RED devices (RED 15 & SD-RED 20)
Multiple Site-to-Site IPsec VPNs
L2TP/IPsec Remote Access VPN (RADIUS authentication)
Active Directory integration
RADIUS authentication
Sophos WAF / Reverse Proxy
Microsoft Exchange publishing (OWA, EWS, Autodiscover, OAB, RPC)
Multiple published websites and web applications
HTML5 VPN Portal
SSL Certificates
IPS enabled
Scope of Work

The selected engineer will assist with:

Reviewing the existing UTM configuration.
Preparing the Sophos XGS for migration.
Using the Sophos Migration Assistant (CLI).
Validating the imported configuration.
Recreating configuration that is not automatically migrated.
Configuring and validating:
Firewall Rules
NAT & Masquerading
Site-to-Site IPsec VPNs
RED devices
Remote Access VPN
WAF / Reverse Proxy
SSL Certificates
Active Directory & RADIUS integration
Troubleshooting and validating all production services during the migration.
Required Experience

Please apply only if you have proven experience with:

Sophos UTM (SG Series)
Sophos Firewall (XGS / SFOS)
Sophos Migration Assistant (CLI)
Sophos RED devices
Site-to-Site IPsec VPN
WAF / Reverse Proxy
Microsoft Exchange publishing
Active Directory / LDAP / RADIUS integration
Enterprise production firewall migrations
What Will Be Provided
Sophos UTM (.abf) backup
Complete configuration exports
Existing firewall documentation
Remote access during the migration
Support throughout the migration process
To Apply

Please answer the following:

How many Sophos UTM → Sophos Firewall XGS migrations have you personally completed?
Have you migrated Sophos RED devices in production?
Have you migrated Sophos WAF / Reverse Proxy configurations?
Have you used the Sophos Migration Assistant (CLI)?
Briefly describe a similar migration project you have completed.

Only applicants with demonstrable Sophos UTM to XGS migration experience will be considered.

I’m looking to engage an experienced ethical-hacking professional who can quickly assess my organisation’s overall security posture and recommend—or perform—the most appropriate next steps. Because I haven’t yet narrowed the scope to a single service, I’m open to anything from a thorough penetration test and security audit to incident-response planning and ongoing threat monitoring.

You’ll begin with a discovery call to clarify the current environment, critical assets, compliance requirements, and any known pain points. From there, I expect you to outline a concise plan of action, including milestones, reporting cadence, and the specific toolsets you intend to use (e.g., Metasploit, Burp Suite, Nessus, Wireshark or equivalents).

Key deliverables
• Executive-level summary of findings and risk ratings
• Detailed technical report with reproducible steps, evidence, and remediation guidance
• Final debrief session to walk me through results and answer questions

Please highlight similar projects you’ve handled, relevant certifications (OSCP, CISSP, CEH, etc.), and your preferred testing methodologies. Fast, clear communication and strict confidentiality are essential.

Skills: Computer Security, Technical Writing, Research Writing, Risk Management, Network Administration, Penetration Testing, Network Security, Data Protection

We are seeking an experienced developer to build a cyber security platform on the Cloud. The ideal candidate will have at least 10 years of experience in cyber security and platform development. Responsibilities include designing and implementing secure cloud infrastructure, conducting penetration testing, and ensuring compliance with security standards. The candidate should be able to work independently.

• Describe your recent experience with similar projects
• Please list any certifications related to this project
• Describe common challenges of maintaining SLAs
• How do you operationalize your projects?

We are seeking a Claude (Anthropic) Certified Senior AI Automation & Security Architect to enhance our real estate investment and construction company. The role involves utilizing GHL to streamline processes and ensure security. The ideal candidate will have experience in AI automation and security, with a focus on real estate applications.

Our organisation’s digital footprint has outgrown the piecemeal protections we put in place over the past few years, so it is time for a coordinated security overhaul. I want a seasoned cyber-security professional to look holistically at our environment, uncover weak points, and help us close them before they become incidents.

Scope
• Full audit of the current estate—on-prem servers, cloud services, publicly facing web components, internal network segments, and any API endpoints.
• Clear, prioritised report of vulnerabilities with risk ratings and practical remediation steps.
• Hands-on implementation or guidance for fixes (patching, hardening, access-control tweaks, WAF rules, etc.), followed by verification testing to confirm each issue is resolved.
• Optional but desirable: a concise security-awareness briefing for key staff so the improvements stick.

Tools & methods are up to you; I am comfortable with industry standards like OWASP, NIST CSF, Nessus, Burp Suite, Metasploit, Wireshark, or comparable stacks if you prefer.

Deliverables
1. Initial assessment report.
2. Remediation plan with timeline.
3. Evidence of completed fixes (screenshots, logs, or retest output).
4. Final summary and next-steps recommendations.

Please outline your proposed approach, estimated timeframe, and any prerequisites you will need from my side so we can get started quickly.

Skills: System Admin, Web Security, Computer Security, Risk Management, Internet Security, Penetration Testing, Cloud Security, Network Security

i need to recover account of mine on instagram thank you

I need someone to crack my software that uses keyauth and some other security services. The job requires the freelancer to fully crack the file and provide a folder with the cracked software in working condition, all features must be usable and should not be broken, the freelancer should remove all security measures from the software

Job Description

We are looking for an experienced Meta/Facebook Account Recovery Specialist who has successfully handled hacked Facebook accounts, disabled accounts, Meta Business Manager ownership issues, and verified Facebook Pages.

Background

The original owner of our Meta Business is Yousafzai Mehran.

His personal Facebook account was hacked. After the hack, Facebook permanently disabled his account.

That account was the owner of our Meta Business assets, including:

Verified Facebook Page Inspired Jackets (Blue Tick)
Multiple Facebook Pages
Meta Business Manager
Other business assets

Our Instagram account (Inspired Jackets) is still active and verified with a Blue Tick.

What Happened

I am Rizwan Khan.

Before the hack, I also had admin access to the Inspired Jackets Facebook Page.

After hacking Mehran's account, the hacker removed me from the Facebook Page and Business assets.

The hacker also invited unknown people to our Facebook Page and business assets.

As a result, we lost ownership and admin control of our Facebook assets.

What We Have Already Tried
Reported the hacked account multiple times.
Used Facebook Hacked Account Recovery.
Contacted Meta Verified Support through live chat.
Contacted Meta Support through email.
Submitted multiple recovery requests.

Facebook can locate the original account, but recovery always stops with:

"Try another device to continue."

Later, Meta informed us that the original Facebook account was permanently disabled.

What We Need

We need an expert who can:

Recover the original Facebook owner account (if possible).
Recover ownership of our Meta Business Manager.
Restore admin ownership of our verified Facebook Page (Inspired Jackets).
Remove unauthorized people added by the hacker.
Guide us through the official Meta recovery and escalation process.
Available Evidence

We can provide:

Meta Support email history.
Meta Verified chat history.
Screenshots of recovery attempts.
Business email.
Government ID of the original owner (if required).
Proof that we own the business and brand.

Please apply only if you have successfully recovered similar Meta Business ownership or hacked Facebook account cases through official Meta channels.

We are seeking a skilled freelancer to set up a network and handle Ubiquiti infrastructure. The ideal candidate will have experience in network administration and security, ensuring a secure and efficient network environment. Responsibilities include configuring network devices, troubleshooting connectivity issues, and optimizing network performance. Familiarity with Cisco routers is a plus.

Hardware networking .....Detail-oriented IT professional with a certification in Hardware and Networking. Skilled in PC assembling, OS installation, and basic LAN/WAN troubleshooting. Eager to leverage foundational knowledge of TCP/IP, routers, and switches to support daily IT operations and resolve end-user issues efficiently.

Skills: System Admin, Linux, Troubleshooting, Cisco, Technical Support, Network Administration, Network Security, Network Engineering

Cloud Network Security Engineer – 100% Remote

Networking:

Equinix: Hands-on experience building out Equinix Fabric (Network edge to CSP, BYOC - BGP service provider level skillsets); Fabric underlay logical resources and overlay virtual device deployments

Firewalls (hands-on build, troubleshooting):

Palo Alto VM/NVA (active/active, active/passive)

Palo Alto PRISMA

Imperva WAF: Configuration and Support for ABP, ATO, CWAF, Policy creation, DDoS mitigation tuning, site onboarding, custom certificate management, CDN



Route/Switch Platforms (hands-on build, troubleshooting):

Cisco Catalyst WAN Edge Routers

Cisco CSR (1000v, 8000v)

Cisco Catalyst Center

Cisco ThousandEyes

Cisco Smart Licensing (8000v)

Arista Spine/Leaf (current h/w)

Juniper MX

Infoblox DDI, vNiOS



MS/Azure:

Azure Advanced Networking - hands-on IaaS build experience (VNet, UDR, NSG, ILB, DNS, NVA's, ExpressRoute/BGP propagation, global peering)

Experience with Azure-native services such as:

Azure API Management (APIM)
Application Gateway (AppGW)
Function Apps with VNet Integration
Azure Data Lake
Private DNS Zones and DNS proxy patterns
Azure Firewall
Azure VWAN (planning, design, implementation)
Private Endpoints
Service Endpoints
Azure Load Balancers


Oracle/OCI – NOT REQUIRED

OCI Advanced Networking - hands-on IaaS build experience (VCN, RT, LPG, DRG Route-Redist, inter-region traffic steering, Layer4/7 LB, OCI private DNS, NVA's, FastConnect/BGP propagation, RPC)
Private DNS Zones and DNS proxy patterns
Oracle App flows and troubleshooting (e.g. OCI DB/Goldengate, AI/ML)
Private Endpoints
Service Gateway
OCI Load Balancer
OCI IAM/Compartments
OCI Landing Zone Architecture


General Cloud Knowledge:

DevOps CI/CD pipelines
Third-party integration/orchestration tools (deployed as PaaS/SaaS)
Understanding of data flows between applications and services (intra/inter-CSP, hybrid/on-prem)
Cloud compute and sizing
Regional Redundancy, Availability Zones and Fault tolerant planning
Knowledge of security best practices across network paths, public endpoints, and service exposure
Collaboration experience with application teams, architects, and security engineers to support scalable cloud deployments.
Understanding of DevOps tooling and pipeline orchestration

Project Overview:

We are looking for an expert, senior-level Enterprise Network Architect/Engineer to lead a multi-vendor project deployment, design review, and the production of final As-Built documentation.
Our current infrastructure environment requires deep architecture alignment across modern software-defined networking (SDN), zero-trust security components, and centralized management fabrics. This is a critical infrastructure project requiring strict adherence to security compliance, high availability, and optimal traffic routing principles.

Scope of Work:

1. Architecture & Design Review

-Conduct a thorough review of the current network topologies, security zones, and high-level designs.
-Identify potential bottlenecks, asymmetrical routing risks, and security gaps before active staging.

2. Multi-Vendor Staging & Deployment Execution

-Palo Alto Networks: Deploy and configure next-generation firewalls (NGFW), including Prisma Access / Prisma SD-WAN architectures and centralized management via Panorama.
-Cisco Systems: Deploy, orchestrate, and validate policy enforcement within a Cisco ACI (Application Centric Infrastructure) environment, alongside core data center Nexus switches (NX-OS mode or ACI leaf/spine fabric integration).
-Fortinet Fabric: Fully configure and deploy FortiGate NGFWs, manage centralized provisioning and policies via FortiManager, and integrate logging/monitoring with FortiSIEM and access control with FortiNAC.

3. Validation & As-Built Documentation

-Perform rigorous post-deployment verification testing (failovers, policy matching, latency checks).
-Produce comprehensive, clear, and professional As-Built Documentation (including accurate Visio diagrams, IPAM registers, policy matrices, and configuration backups).

Required Technical Expertise:
-Palo Alto: Deep operational experience with Panorama, Prisma Access, and NGFW capabilities. PCNSE (Palo Alto Networks Certified Network Security Engineer) highly regarded.
-Cisco Data Center: Demonstrated expertise in Cisco ACI architecture (APIC controllers, tenant/EPG configurations, contracts) and Nexus platforms (9K/7K/5K). CCNP Data Center or CCIE preferred.
-Fortinet Fabric: Solid track record deploying FortiGate, FortiManager, FortiSIEM, and FortiNAC. NSE 7 or NSE 8 certification is a massive advantage.
-Documentation: Exceptional technical writing skills with the ability to map out complex multi-vendor workflows clearly.

Project Details:
-Project Type: Fixed-term / Milestone-based preferred (open to hourly for the right elite candidate).
-Location: Remote, but must be available for overlap during core business hours for sync meetings and deployment windows.
-Duration: 1–3 months

How to Apply:
-Please provide a brief summary of your experience handling multi-vendor deployments of this scale. In your application, please highlight:
-A brief overview of a recent Cisco ACI or Prisma deployment you successfully executed.
-Your availability for scheduled migration windows.
-Optional but preferred: A redacted example of a previous As-Built or network design document you have authored.

Skills: Troubleshooting, Technical Writing, Report Writing, Cisco, Network Administration, Internet Security, Documentation, Network Security, Network Engineering, Firewall

Must Have Technical/Functional Skills
1.    Azure Cloud Network, AWS Cloud Network, Cisco SD WAN, Ansible automation,
Terraform automation, Cisco ISE, DNS, Imperva, Cloud Flare, Site 2 Site VPN, and PowerShell
2.    Expert-level experience in managing enterprise Routing & Switching (Cisco, HPE),
SD-WAN (Meraki), Wireless (Ubiquiti), F5 Load Balancer & and Wireless infrastructures
3.    Cloud Networking though IaC via CI/CD

Roles & Responsibilities
1.    Create New, Manage and maintain CI/CD pipeline on Cisco, HPE, Cisco Meraki, and Ubiquiti
2.    Reviewing, configuring, and troubleshooting Cloud Networking and
Security controls (e.g., VPCs, Subnets, NSGs, SGs, and routing in AWS/Azure).
3.    Deep operational experience executing network lifecycle management,
including vulnerability mitigations, firmware upgrades, and IOS patch management.

Our internal security team needs an external, red-team style penetration test focused exclusively on the network infrastructure. I want you to simulate real-world attacks against three key components—our firewalls, routers & switches, and enterprise-grade wireless networks—to see how quickly and effectively our blue team detects, contains, and responds.

Scope
• Engage the perimeter and internal segments behind our firewalls.
• Enumerate and exploit misconfigurations on Cisco-class routers and layer-3 switches.
• Probe the corporate and guest Wi-Fi environments, including roaming vulnerabilities and weak encryption scenarios.

Primary objective
The engagement is not just about finding vulnerabilities; the bigger aim is to pressure-test our incident-response playbook. Throughout the exercise you will coordinate with a single point of contact for rules of engagement and safety words, then launch attacks without tipping off the responders. I expect time-stamped logs of every action so we can replay the event afterward.

Deliverables
• Pre-engagement test plan and ROE outline
• Live attack window (agreed schedule) with continuous time-sync logging
• Comprehensive final report detailing:
– Attack paths and exploited weaknesses
– How and when each activity should have been detected
– Recommendations for tooling, alerting, and process improvements
• Post-mortem call to walk our team through the findings and answer technical questions

Acceptance criteria
All findings must be reproducible and mapped to MITRE ATT&CK techniques; proof-of-concept code or packet captures should accompany critical issues.

Preferred toolset is up to you—Kali Linux, Nmap, Metasploit, Wireshark, and other standard offensive security frameworks are all acceptable provided no commercial license constraints are introduced.

The engagement will be fully remote using VPN access we provide, and must comply with local laws and our internal change-control policy. Let’s agree on the dates and you can start crafting the attack plan right away.

Skills: Wireless, Computer Security, Cisco, Network Administration, Penetration Testing, Network Security, Risk Assessment, Network Monitoring

Job Description

About the Project

We are looking for a Senior VMware Infrastructure Specialist / Solutions Architect to analyze, plan, and execute a comprehensive vulnerability remediation plan for two of our production vSphere clusters.

Security teams have reported critical vulnerabilities affecting our ESXi hosts. The main objective is to design a strict remediation timeline with controlled maintenance windows and mitigation strategies, minimizing operational impact and ensuring business continuity.

Key Vulnerabilities & Associated Risks to Address

The selected specialist will be responsible for mitigating risks that directly impact our infrastructure, specifically including:

Information Leakage (Side-Channel Vulnerabilities): Addressing flaws like Foreshadow and Spectre that potentially allow unauthorized access to sensitive data in memory, including VM-adjacent data.

Unauthorized Code Execution: Mitigating potential remote exploitation risks that could allow attackers to execute arbitrary code on ESXi hosts.

VM Escape / Isolation Compromise: Eliminating risks that allow breakout from a virtual machine, compromising other workloads on the same host.

Denial of Service (DoS): Hardening hosts against exploits designed to cause system instability or downtime.

Out-of-Bounds Memory Read: Remediation of flaws exposing critical system memory boundaries.

Scope of Work & Deliverables

The consultant will be expected to guide us through three main phases:

Technical & Operational Impact Assessment:Analyze the affected IP lists and current hardware/software versions against the VMware Compatibility Guide (HCL).Evaluate the performance impact (especially on CPU/memory overhead) of enabling hardware-level mitigations like Side-Channel Awareness (SCA).Perform capacity planning to ensure our clusters can support an $N+1$ or $N+2$ topology while hosts are in Maintenance Mode during live vMotion migrations.

Remediation Plan & Controlled Schedule:Define a step-by-step remediation roadmap (e.g., vCenter updates prior to ESXi patching).Establish clear maintenance windows and a definitive rollback/contingency plan for each cluster.Propose temporary mitigation measures or official hardening guidelines for scenarios where immediate patching is not viable or a "does not apply" status needs formal justification.

Execution & Validation:Apply the necessary security updates, patches, or configuration changes.Validate system stability post-patching and coordinate with our security team to confirm successful remediation.

Required Profile / Qualifications

Experience: 7+ years of Enterprise IT Infrastructure design and VMware administration. Proven track record managing critical maintenance windows in high-availability production environments.

Technical Expertise: Deep knowledge of VMware vSphere (vLCM/Update Manager), cluster high availability (HA/DRS), live migrations (vMotion), and ESXi Kernel advanced configurations.

Certifications (Highly Valued): VMware Certified Professional (VCP-DCV) or VMware Certified Advanced Professional (VCAP). Security-focused certifications (CISSP, CEH) are a big plus.

Soft Skills: Strong documentation habits, risk management mindset, and ability to translate security requirements into low-impact operational procedures.

Language: Spanish fluency is required for internal alignment, but technical command of English is expected for documentation and vendor support.

If you have the senior expertise required to secure enterprise virtualization platforms without disrupting daily operations, please submit your proposal along with a brief summary of similar patching or hardening projects you have successfully completed.

• Describe your recent experience with similar projects
• Please list any certifications related to this project

Look for someone with experience in:

* WordPress security hardening
* Malware cleanup
* Vulnerability remediation
* Plugin conflict resolution
* PHP
* MySQL
* Apache/Nginx
* Cloudflare
* Linux
* WP-CLI
* OWASP Top 10
* Patch management
* Wordfence (or similar)
* Security headers
* CSP/HSTS
* SSL/TLS

We are seeking a specialist in personal security or cybersecurity who is a phenomenal English speaker and presenter. The role involves presenting security concepts to various audiences, ensuring clarity and engagement. The ideal candidate must be a specialist in personal security hygiene with strong communication skills and the ability to convey complex information effectively, through this podcast. Join Quanta Tech Systems to help us deliver an impactful presentation.

Need assistance with verifying a GSuite domain and setting up a new website on Netlify. The task requires ensuring that the email services are not disrupted during the process. The budget for this task is $50 per project.

Responsibilities

Designing, redesigning, and implementation of connectivity, security, delivery and monitoring services relating to virtual networks, VPN, NAT gateways, DNS, load balancers, web application firewalls, application gateways, etc.
Extensive experience in networking within large enterprise environments, including WAN, LAN, data centers, and cloud environments.
Design, deploy, and manage cloud-based network solutions using Azure, GCP and AWS platforms
Develop and implement strategies for seamless cloud integration, including hybrid cloud environments.
Experience with HPE Aruba network solutions, including wireless and wired networking
Experience designing and implementing BGP routing policies to ensure optimal path selection and traffic engineering.
Continuously adapts and fine-tunes architecture, configuration standards, and protocols in partnership with Infrastructure and Security teams.
Knowledgeable in network security best practices and integration.
Developing, designing, and implementing network roadmap, architecture, standards, and governance
Monitor network performance using advanced tools and techniques, identifying and resolving issues proactively.
Contribute in continuous process development, improvement, and automation of Perimeter Defense related solutions and support activities.
Collaborate with cross-functional teams to ensure seamless network operations.

Requirements
5+ years of designing, deploying of experience, maintaining, and improving on-prem and cloud networks
Experience with cloud networking technologies, including VNETs, ExpressRoute, User Defined Routes, Network Security Groups, Load Balancers, Application Gateways, DNS, Route Servers, and Network Managers.
Proficiency in configuring and managing Cisco Switches, HPE Switches.
Extensive background in core networking technologies such as TCP/IP, STP, HSRP, NAT, QoS, SNMP, and SYSLOG.
Proficiency in routing technologies, specifically BGP.
Knowledge of ITIL, and change management processes
Self-starter with high energy to meet the needs of a demanding business and IT environment.

We are seeking a specialist to optimize our Google Business Profile and set up BrightLocal. The ideal candidate will have experience in local SEO and business listing management. Responsibilities include enhancing our GBP listing, ensuring accuracy, and setting up BrightLocal for ongoing monitoring and improvement. The goal is to improve our online presence and visibility in local search results.

Install and terminate CAT6 across four to six classrooms and the main equipment closet of a school. All cable, jacks, patch panels, and faceplates are already on site; the task is to route the runs cleanly, terminate to TIA-568B, label every drop, and provide a certified test report (Fluke or equivalent).

Access to the building can be arranged after school hours or on weekends next month—state the dates that work best for you. Please include in your bid:

• brief summary of comparable CAT6 jobs you have completed, ideally in educational or multi-room settings
• the tools and testers you will bring
• estimated time to complete the work
• your total rate for the one-time project

Payment is released once the test report is handed over and every outlet passes gigabit performance.

Skills: Telecommunications Engineering, Network Administration, Telecom Sales, Network Sales, Telecoms Engineering, Network Security, Network Engineering, Network Monitoring

I want to recover my page; a competitor reported me.

• Please list any certifications related to this project
• Describe your recent experience with similar projects
• How will you suggest improvements if you disagree with an existing process?

A. Using unauthorized versions of Cobalt Strike to brutally force access into victims' computers; using unauthorized versions of Cobalt Strike to operate a global malware and ransomware infrastructure, using unauthorized versions of Cobalt Strike to deploy malware and ransomware to victims' machines; using unauthorized version of Cobalt Strike to offer RaaS to other malicious actors; using the Conti and LockBit ransomware deployed via unauthorized Cobalt Strike to run and add its own protocols to the Microsoft operating system to go through the list of services [*3] and terminates services that are related to backup and recoveries as well as terminating security processes related to operating tool, which causes hundreds of lines of Microsoft's declaring code and the structure, sequence, and organization of that code are copied with and across unauthorized, cracked Cobalt Strike modules and ransomware like LockBit; using the infected victims' computers to send commands and instructions to the infected computing device to control it surreptitiously and deliver malware that, among other things, enables Defendants to take control of the victim's computer and extort money from them. Defendants' primary goal is to deliver ransomware and enable attacks against other computers; or stealing information, money or property from Plaintiffs, Plaintiffs' customers or Plaintiffs' member organizations, or undertaking any similar activity that inflicts harm on Plaintiffs, or the public, including Plaintiffs' customers or associated member organizations

B. Configuring, deploying, operating or otherwise using or unauthorized Cobalt Strike to facilitate the deployment of defendants' malware and ransomware activities described in the TRO Application, including but [*4] not limited to the C2 infrastructure hosted at and operating through the domains and IP addresses set forth herein and through any other deployments of unauthorized Cobalt Strike in any location.

Skills: Web Security, Computer Security, Windows Server, Risk Management, Internet Security, Penetration Testing, Network Security, Digital Forensics, Data Protection, Intellectual Property Law

We are seeking an ethical hacker to help improve our score by identifying vulnerabilities and providing recommendations for enhancement. The ideal candidate will have experience in penetration testing and ethical hacking, with a strong understanding of network security. Your expertise will be crucial in ensuring our systems are secure and efficient.

UPWORK JOB POSTING

Comprehensive Security, Vulnerability, and Compliance Testing Engagement

Mobile Application • Website • Financial Infrastructure • Chain of Custody Architecture

ISO 42001 • NIST AI RMF • NIST SP 800 series • OWASP • Federal Digital Evidence Standards

Fixed Price — 9,200 USD • Four Milestones • Milestone Certifications Required

---

READ THIS FIRST — DO NOT APPLY IF YOU CANNOT SATISFY ALL REQUIREMENTS

This engagement requires a REGISTERED BUSINESS ENTITY — not an individual freelancer — that has previously produced security certifications, compliance certifications, and forensic integrity reports that have been accepted in professional, legal, or regulatory contexts.

VENDORS WHO DO NOT MEET ALL OF THE FOLLOWING SHOULD NOT APPLY. YOUR PROPOSAL WILL BE IGNORED:

Your organization holds active CREST, CERT In empanelment, or equivalent nationally recognized cybersecurity accreditation verifiable through a public registry
Your organization holds ISO 27001, SOC 2 Type II, or CMMC Level 2 certification for your OWN operations
Your team includes a named examiner with CFCE, EnCE, ACE, GCFE, or GCFA certification for the forensic integrity report
Your team includes a named examiner with OSCP, CEH, GPEN, or GMOB certification for penetration testing
Your organization has previously issued security certifications and compliance certifications that have been presented in legal proceedings, regulatory submissions, or enterprise procurement processes
Your organization has conducted prior mobile application security assessments on iOS and Android physical devices
Your organization has prior experience with United States federal and state regulatory requirements including COPPA, BIPA, and recording consent law

Vendors who cannot satisfy all of these requirements should not apply. AI-generated proposals that do not answer the competency screening questions with specific, verifiable, experience-based answers will not be reviewed.

---

MILESTONE CERTIFICATION REQUIREMENT — THIS IS NON-NEGOTIABLE

The engagement requires the contractor to issue a written certification on official business letterhead at the completion of each milestone. These are not summary reports. They are formal certifications signed by an authorized officer of the contractor's registered business entity that state specifically what was tested, what passed, and that the tested components are certified as meeting the standards applied in the engagement.

MILESTONE 1 CERTIFICATION IS THE MOST CRITICAL. The platform may receive subpoenas or law enforcement requests for recorded evidence during its beta launch period. Milestone 1 specifically covers the chain of custody architecture, evidence package delivery security, and 51-jurisdiction recording consent compliance. The Milestone 1 certification — issued on official letterhead within 15 business days of engagement start — is the document the client presents if compelled to produce recordings to a court or law enforcement agency during beta. Without it the platform has no independent verification of its forensic integrity.

If a contractor cannot issue an official business letterhead certification with an authorized officer signature, a unique traceable reference number, and independent verification contact information for each milestone that passes — that contractor cannot perform this engagement.

Certifications must be independently verifiable. Law enforcement, attorneys, and courts must be able to contact your organization directly to verify any certification issued under this engagement.

---

1. ENGAGEMENT OVERVIEW

A consumer-facing mobile application operating across all 50 US states and Washington DC requires a comprehensive independent security, vulnerability, and compliance testing engagement before official public launch. The platform is a compliance-grade personal safety and forensic evidence documentation system. Its Evidence Vault stores audio and video recordings made under a 51-jurisdiction recording consent compliance engine. Evidence Packages from the platform are submitted to law enforcement officers, licensed attorneys, private investigators, and courts as forensic evidence in civil and criminal legal proceedings.

This is not a standard mobile application security audit. The platform's outputs will be used as evidence in criminal prosecutions. The certifications produced under this engagement will be presented to District Attorneys, defense counsel, judges, law enforcement agencies, and enterprise procurement officers. The forensic integrity report produced under this engagement is a court-presentation document that must withstand cross-examination by a defense attorney. Every deliverable in this engagement carries legal evidentiary weight. Vendors who approach this as a routine VAPT engagement are not the right fit.

The complete Statement of Work covering all testing requirements, formal test cases, acceptance criteria, milestone deliverables, and contractor qualification requirements will be provided as an attachment to qualified candidates after initial screening. This posting is a summary and screening document only.

---

2. SCOPE SUMMARY — FOUR MILESTONES

MILESTONE 1 IS TIME-CRITICAL AND NON-NEGOTIABLE ON TIMELINE

Milestone 1 must be completed within 15 business days of the written green light from the client. This timeline is a condition of the engagement, not a target. A contractor who cannot commit to 15 business days for Milestone 1 should not apply.

Milestone 1 covers the components required if a court order, subpoena, or law enforcement evidence request arrives during the beta period. The certification issued at Milestone 1 completion is the legal verification document for this scenario.

Milestone 1 — Court-Order Readiness Certification — 2,500 USD — 15 Business Days

Part A Security Testing: Chain of custody architecture security across four flows — inbound vendor certification document upload (9 test cases including dual-authorization model, revocation, APN port access control, and HASH_COMPROMISED status), outbound evidence package transmission to law enforcement, attorneys, and private investigators (6 test cases), outbound certification document request and delivery (8 test cases including 72-hour link expiry and rejection notification), and SHA-256 cryptographic integrity across all flows (7 test cases including rate limiting and end-to-end hash chain)

Part A Security Testing: Evidence Package access and chain of custody penetration testing for all four recipient classes — trusted contacts, licensed attorneys, law enforcement officers, and private investigators — including credential bypass testing and cross-recipient sequential chain integrity

Part B Compliance Verification: 51-jurisdiction Compliance Decision Engine verification — JUR-01 through JUR-04 and REC-01 through REC-05 verified across all 51 US states and Washington DC using simulated GPS on physical iOS and Android devices

Milestone 1 Deliverable: Interim Chain of Custody and Evidence Delivery Certification issued on official business letterhead, signed by authorized officer, unique reference number, stating what was tested, what passed, what was not tested in this milestone, and the platform version tested

---

Milestone 2 — Mobile Application Security Assessment — 2,000 USD — 30 Business Days

Part A: Complete iOS and Android mobile application security assessment on physical devices — VAD acoustic embedding data handling, BIPA and state biometric privacy verification across 11 enumerated states, VAD behavioral accuracy testing across 6 scenarios with 80/85 percent acceptance thresholds, Fake Call compliance testing across 5 formal test cases, VAD session start delay gate across 5 scenarios, COPPA compliance across 11 test items, SOS emergency dispatch sandbox testing across 5 controls, iOS silent mode compliance fallback, website penetration testing, enterprise account security across 6 test areas

Milestone 2 Deliverable: Mobile Application Security and Vulnerability Assessment Report with separate iOS and Android findings for every single test — no combined results accepted — device make, model, and OS version documented, severity ratings, remediation recommendations, on official letterhead

Milestone 2 Certification: Written certification on official letterhead that mobile application security testing for Milestone 2 scope was completed and all Critical and High findings were retested and confirmed resolved

---

Milestone 3 — Infrastructure and Financial Security Assessment — 1,500 USD — 40 Business Days

Part A: Payment and webhook security — Stripe Connect multi-entity isolation, webhook signature validation, replay attack testing, IRS transfer pricing fourteen-field metadata schema integrity, subscription privilege escalation

Part A: Financial infrastructure security — third-party accounting integration injection point and Smart Rules security, six-file multi-entity accounting access isolation, intercompany transaction integrity, financial audit trail immutability and export for CPA review

Part A: GPS, live map, and family location security — simulated GPS jurisdiction detection across all 51 states on physical iOS and Android devices, GPS spoofing resistance, five Profile A and B state border scenarios, on-device reverse geocoding verification, live map access control, family GPS at maximum account member count using mixed iOS and Android device configuration

Milestone 3 Deliverable: Infrastructure and Financial Security Assessment Report with separate iOS and Android results for all GPS and location tests, financial infrastructure findings documented separately, on official letterhead

Milestone 3 Certification: Written certification on official letterhead that infrastructure and financial security testing for Milestone 3 scope was completed and all Critical and High findings were retested and confirmed resolved

---

Milestone 4 Final — Full Compliance Verification and Four Certifications — 3,200 USD — 55 Business Days

Part B: Full 48-control Implementation QA Compliance Checklist verification across all 10 control categories and all account tiers — consumer, professional, and enterprise — with separate iOS and Android results

Part B: BIPA compliance across all 11 enumerated states, VAD behavioral accuracy thresholds confirmation, Washington state announcement-in-recording verification, Delaware profile classification correction, enterprise account compliance, financial compliance including IRS transfer pricing rules and accounting audit trail export, NIST SP 800 series test coverage adequacy gap report

Milestone 4 Required Deliverable 1 — FORENSIC INTEGRITY VERIFICATION REPORT: Court presentation standard. CFCE, EnCE, ACE, GCFE, or GCFA certified examiner. Minimum 500-word methodology. Independent SHA-256 verification table for minimum 10 test files. Minimum 5 WORM mutation attack vectors. Minimum 3 Legal Hold bypass scenarios. Expert conclusion statement. Statement of examiner independence. Official letterhead.

Milestone 4 Required Deliverable 2 — PART A SECURITY CERTIFICATION: All Critical and High vulnerabilities retested and confirmed resolved. Authorized officer signature. Official letterhead.

Milestone 4 Required Deliverable 3 — PART B COMPLIANCE CERTIFICATION: All required controls confirmed operational across all account tiers. Compliance attorney opinion letter reference number cited. Authorized officer signature. Official letterhead.

Milestone 4 Required Deliverable 4 — CERTIFICATE OF STANDING: Complete engagement scope covered. All findings status documented. No Critical or High vulnerabilities remain open. All 48 controls and 51 jurisdictions verified. Authorized officer signature. Unique certificate reference number. Official letterhead.

ALL FOUR MILESTONE 4 DOCUMENTS ARE REQUIRED SIMULTANEOUSLY. Payment releases only when all four are received and accepted. Receipt of three does not trigger payment.

---

3. ENGAGEMENT PROTOCOL

Start-stop engagement: Testing for each milestone begins only upon written green light from the client confirming the development team is ready. Timeline clocks start from the green light date, not the contract start date.

Hold notices: The client may pause any milestone if additional development work is required. The vendor must resume within five business days of the new green light.

Remediation and recheck: When findings are identified the development team remediates and the vendor retests. After all Critical and High findings are resolved the vendor conducts a full recheck of every previously passing test case within that milestone before issuing the milestone certification.

Advancement gate: The vendor may not advance to the next milestone without written client acceptance of the current milestone deliverable, milestone payment released, and written green light for the next milestone.

---

4. CERTIFICATION AUTHORITY REQUIREMENTS

The certifications issued under this engagement will be presented in criminal proceedings, civil litigation, law enforcement investigations, and enterprise procurement processes. A certification from a contractor who lacks institutional standing has no value in these contexts.

Every certification issued under this engagement must: be on official business letterhead with your registered business address and active website address, be signed by a principal or authorized officer of your registered entity, carry a unique traceable reference number, be independently verifiable by contacting your organization directly, include a dedicated verification contact on the certificate face, and state the name and active credential of every examiner who contributed to the assessment.

Your organization must have previously issued certifications that have been accepted in professional or legal contexts. Certifications that have never been presented outside a client's internal files do not satisfy this requirement.

---

5. MANDATORY COMPETENCY SCREENING QUESTIONS

THESE QUESTIONS MUST BE ANSWERED IN FULL. INCOMPLETE OR GENERIC ANSWERS WILL RESULT IN DISQUALIFICATION.

These questions are designed to verify direct hands-on experience and institutional competency. They cannot be answered satisfactorily using general knowledge or AI-generated text. Each answer must be specific, verifiable, and grounded in your organization's actual prior work.

Section A — Forensic Integrity and Chain of Custody

Question 1. Describe a specific prior engagement where your organization produced a forensic integrity report for a digital evidence preservation system that was presented in a legal proceeding. Identify the type of proceeding (criminal, civil, regulatory), the role the report played, and the outcome. Do not identify the client by name if confidential but describe the industry and nature of the system. What specific tests did your examiner conduct and what tools were used to independently verify SHA-256 hashes?

Question 2. Your organization is about to certify a WORM-protected evidence vault for a consumer mobile application. The vault stores audio and video recordings in 5-to-10-second chunks each with an independent SHA-256 hash. A defense attorney challenges the vault integrity by arguing that the hash verification relies on the platform's own tools rather than independent verification. Walk through your methodology for responding to this challenge. What specific independent tools do you use? How do you document the independence of your verification in a way that satisfies a court?

Question 3. Your organization is required to produce a chain of custody log export for a single certification document that was transmitted to a law enforcement officer, then to a District Attorney, then introduced as evidence in a federal criminal proceeding. The export must be suitable for court submission. Describe the format, required fields, and structure of that export document. How does your organization ensure the chain of custody log is append-only and tamper-resistant? What happens to the chain of custody record if the platform is acquired or restructured?

Section B — Mobile Application Security Testing

Question 4. Your team is testing a Voice Activity Detection engine on a physical iOS device. The engine creates ephemeral acoustic embeddings in RAM during a session and is required to destroy them at session end with no persistent storage and no off-device transmission. Describe your methodology for verifying that the embeddings are truly destroyed at session end and that no data remnants exist. What OS-level tools and memory analysis techniques do you use on iOS specifically? How does your approach differ on Android?

Question 5. During a mobile application penetration test you discover that the jurisdiction detection engine — which determines which recording consent profile to apply based on GPS location — can be spoofed by a GPS mock application. The engine defaults to the most permissive recording profile when GPS confidence is low rather than the most restrictive profile. Classify this finding by severity and explain your reasoning. What attack scenarios does this enable? What remediation do you recommend and how do you verify the remediation is effective at the enforcement layer rather than only the UI layer?

Question 6. Describe a prior engagement where your organization tested COPPA compliance controls on a consumer mobile application. What specific tests did you conduct? What is the FTC's current civil penalty exposure for COPPA violations and how does that inform your testing priority? What is the specific legal threshold that triggers COPPA obligations and how do you verify a platform's age gate satisfies it?

Section C — Compliance Verification and Framework Assessment

Question 7. A mobile application operates across all 50 US states and Washington DC. It records audio and video of users and nearby third parties during real-time safety sessions. Different states require different levels of consent — some require only one-party consent, others require all-party consent with an audible notice. The platform has implemented four recording consent profiles driven by a Compliance Decision Engine that detects jurisdiction from GPS. Name three specific states where all-party consent is required, cite the applicable statute for each, and describe what the platform must do technically to satisfy each statute's notice requirements. Then explain what Profile B means in a multi-participant session where participants are in different consent-profile states.

Question 8. Your organization has been asked to verify that a platform satisfies NIST SP 800 series control testing requirements across 48 control IDs spanning 10 compliance categories. The existing automated test suite has 185 tests across 37 suites. Describe specifically how you evaluate whether an existing automated test suite meets NIST SP 800 series adequacy standards. What control families are most commonly under-tested in consumer mobile applications? What does your gap report look like and how do you structure your remediation recommendations so a development team can implement them efficiently?

Question 9. The platform's Voice Activity Detection engine must satisfy the Illinois Biometric Information Privacy Act. The engine creates in-memory acoustic embeddings during recording sessions and destroys them at session end. The embeddings are never written to persistent storage and never transmitted off-device. A plaintiff's attorney argues the acoustic embeddings constitute biometric identifiers under BIPA because they are derived from biological characteristics. Evaluate this argument. Does the ephemeral in-memory implementation trigger BIPA's requirements? What specific statutory language is determinative? How does your organization document the compliance position in a way that would support a motion to dismiss a BIPA class action?

Section D — Certification Issuance and Institutional Standing

Question 10. Provide a description of a prior security certification or compliance certification your organization has issued that was subsequently presented in a legal proceeding, regulatory submission, or enterprise procurement process. Describe the certification's content, who signed it, how it was verified by the receiving party, and what role it played. You may redact client names and case identifiers. The description must include the type of proceeding, the jurisdiction, and the specific compliance or security standards the certification addressed.

Question 11. A law enforcement officer contacts your organization six months after you issued a Milestone 1 chain of custody certification for a mobile platform. The officer is preparing to testify in a federal criminal proceeding and needs to verify that the certification is authentic, that the named examiner held the stated credentials at the time of testing, and that the platform version tested matches the version from which the evidence was produced. Walk through exactly how your organization handles this verification request. What documentation do you maintain, for how long, and through what internal process does a verification request get handled?

Question 12. Your organization has just completed security testing for a milestone and identified three Critical vulnerabilities and four High vulnerabilities. The development team has remediated all seven. You have retested and confirmed all seven are resolved. Before issuing the milestone certification you are required to conduct a full recheck of every test case within the milestone that previously passed. During the full recheck you discover that one remediation introduced a regression — a test case that previously passed now fails. How do you handle this? What does your certification say about the discovered regression? What is your communication process with the client? How do you document the regression discovery in the chain of custody of your own testing records?

Section E — Financial Infrastructure and GPS Security

Question 13. A multi-entity payment platform uses Stripe Connect with a platform master account and connected accounts for multiple operating entities. A security assessment must verify that the connected account architecture does not allow one entity's payment data to be accessed through another entity's credentials. Describe your methodology for testing this isolation. What specific API calls do you make, what attack vectors do you test, and how do you verify that the IRS transfer pricing metadata stamped on PaymentIntents cannot be stripped or modified through any accessible API endpoint?

Question 14. A consumer mobile application must convert GPS coordinates to neighborhood-level descriptors on-device before transmitting location information in SMS alerts. Raw GPS coordinates must never appear in any outbound transmission. Describe your methodology for verifying that raw GPS coordinates are not present in any SMS payload, push notification, or API call under any device state — including degraded GPS reception, background mode, and airplane mode. What tools do you use to intercept and analyze outbound network traffic on physical iOS and Android devices simultaneously?

---

6. PROPOSAL REQUIREMENTS

PROPOSALS MISSING ANY OF THESE ELEMENTS WILL NOT BE REVIEWED

1. Full answers to all 14 competency screening questions above. Answers must be specific and experience-based. Generic or AI-generated answers will be identified and disqualified.
2. Your company's full legal registered name, business registration number, jurisdiction of registration, and active public-facing website address.
3. Your organization's accreditation reference number (CREST registration, CERT In empanelment number, or equivalent) and the public verification registry where it can be independently verified.
4. Your organization's own ISO 27001, SOC 2 Type II, or equivalent certification reference number and issuing body.
5. The full name, active certification name, certificate number, issuing body, and expiry date of the forensic examiner who will produce the Milestone 4 forensic integrity report. Minimum credential: CFCE, EnCE, ACE, GCFE, or GCFA.
6. The full name, active certification name, certificate number, issuing body, and expiry date of the lead Part A penetration testing examiner. Minimum credential: OSCP, CEH, GPEN, or GMOB.
7. A SAMPLE PART A SECURITY CERTIFICATION previously issued by your organization on official business letterhead. Client names may be redacted. Must show authorized officer signature, unique reference number, scope certified, and examiner credentials. Required separately from the compliance certification sample.
8. A SAMPLE PART B COMPLIANCE CERTIFICATION previously issued by your organization on official business letterhead. Must show authorized officer signature, unique reference number, compliance framework and control scope verified, and lead examiner credentials. Required separately from the security certification sample.
9. Part A pricing and Part B pricing as separate line items with a combined total not exceeding 9,200 USD.
10. Written confirmation that your organization can issue a Milestone 1 interim certification within 15 business days of the written green light and that this timeline is a firm commitment, not an estimate.
11. Written conflict of interest disclosure confirming no relationship with any competitive platform in the personal safety application or evidence documentation market.

---

7. COMPLETE SOW PROVIDED TO QUALIFIED CANDIDATES

The complete Statement of Work — covering all formal test cases, acceptance criteria, contractor qualification requirements, milestone deliverable specifications, start-stop protocol, remediation and recheck procedures, chain of custody requirements, and certification issuance standards — will be provided to candidates who pass initial screening.

Initial screening is based on the competency questions above and the proposal requirements above. Candidates who are screened in will receive the full SOW and will be asked to confirm their proposal covers the complete scope before award.

Do not request the full SOW before submitting your proposal. The SOW will not be shared with candidates who have not submitted a complete proposal meeting all requirements above.