Penetration Testing and Vulnerability Assessment Provider (NCA-Registered, KSA Experience)
Company: Dwelleo, an AI-powered real estate marketplace operating in Saudi Arabia
Engagement: Fixed-scope project, remote (Egypt-based provider welcome)
Timeline: Start immediately. Final report and retest within 10 working days.
About the project
Dwelleo is integrating with a Saudi government real estate platform. As part of that integration we must submit an independent vulnerability assessment report and a penetration test report, and all findings must be closed before integration is approved. We need a provider who has done this for Saudi clients and understands what Saudi regulators expect to see in the report.
Scope
- Web application and APIs (Laravel-based microservices)
- Mobile apps (iOS and Android)
- Cloud and server infrastructure, for both test and production environments
- AI components: prompt injection, data leakage between tenants, and abuse of AI-driven features
Deliverables
- Vulnerability assessment report for the test environment and for production
- Penetration test report with methodology, scope, and findings
- CVSS-rated findings, each with reproduction steps and remediation recommendations
- Executive summary suitable for submission to a government body
- Retest report confirming that all findings are closed
- Remediation support: short calls to clarify findings with our engineers
Required
- Registered with the National Cybersecurity Authority (NCA) through the Haseen portal. Provide your registration details. If you are an individual, you must work under an NCA-registered firm.
- Proven experience delivering penetration tests for clients in Saudi Arabia, with at least two references or sample (redacted) reports
- Tester(s) holding recognised certifications, such as OSCP, OSWE, CREST or equivalent
- Familiarity with NCA Essential Cybersecurity Controls (ECC) and how test reports are mapped to them
- Experience testing web, mobile, and API applications; OWASP Top 10, OWASP API Top 10 and OWASP MASVS
- Willingness to sign an NDA and to follow agreed rules of engagement
- Written English; Arabic is a plus
Nice to have
