Comprehensive Web & System Security Assessment

Scope of Work

* Perform security assessment of web application (Python/Django) and APIs
* Test authentication, authorization (RBAC), and session management
* Identify vulnerabilities (e.g., SQLi, XSS, command injection, API abuse)
* Assess Linux and Windows endpoint agents for:
* Privilege escalation risks
* Service configuration and permissions
* Secure communication (TLS)
* Evaluate on-prem server security:
* Open ports/services
* OS hardening
* User access and permissions
* Conduct network security testing:
* Data in transit (encryption)
* Internal communication paths
* Review installation and deployment process:
* RPM/package security
* Configurations and secrets handling

⸻
Deliverables

* Detailed security report with severity ratings
* Proof of concept (PoC) for findings
* Remediation recommendations
* Optional retest after fixes

⸻
Required Experience

* Web application & API penetration testing
* Linux and Windows system security
* Endpoint/agent security (preferred)
* Experience with on-prem environments

⸻
Nice to Have

* Experience with OT/SCADA environments
* Familiarity with NERC CIP or compliance frameworks