Security QA Engineer – Multi‑Tenant Isolation

About the role

We are building a cutting‑edge AI Governance Orchestration platform and need a Security QA Engineer to guarantee absolute data isolation between tenants. You will design, execute, and document rigorous tests that prove one client’s data can never be accessed by another, delivering a signed audit report for our first enterprise customer.

Key responsibilities

• Construct and maintain a dual‑client testing environment with segregated users, roles, and databases.
• Perform targeted attacks on client boundaries across all interfaces, including APIs, UI, and background services.
• Identify and exploit vulnerabilities such as resource ID manipulation, token injection, privilege escalation, cache/queue poisoning, and noisy‑neighbor resource exhaustion.
• Validate isolation in hidden pathways like reports, data exports, search, file downloads, push notifications, system logs, backups, and hard deletions.
• Ensure per‑client audit logs and telemetry are fully separated and attributable.
• Automate successful manual attacks into repeatable test suites that run on every release.
• Draft, update, and maintain the official Data Isolation Audit Report.
• Mentor two QA interns on isolation testing methodologies.

Required profile

• Proven hands‑on experience in web and API security testing.
• Ability to intercept and manually modify network requests (e.g., using Postman or Burp Suite).
• Deep architectural understanding of Role‑Based Access Control and multi‑tenant systems.
• Strong proficiency with test automation frameworks.
• Excellent technical writing skills in English for audit documentation.
• Detail‑oriented, methodical approach to security testing.

Required skills

• API security testing
• Multi‑tenant systems
• Role‑Based Access Control
• Test automation frameworks
• Burp Suite
• Postman