Security and Penetration Testing - Volunteer

Help keep an online one-to-one tutoring platform for children and young people safe. Join our Agile product team as a volunteer security tester, probe the application and its APIs, and help us fix what you find. Open to testers with at least 3 years experience. What difference will you make? Play a vital role in helping Ignite Hubs deliver high-quality, inclusive tutoring to children and young people who need it most. We work particularly with girls, those from disadvantaged backgrounds, and those from underrepresented backgrounds. Your contribution protects the young people who use the platform and the data they trust us with, and gives schools, parents, carers and funders the confidence that it is safe to use. What are we looking for? What qualities and experience should your volunteer have? Essential

• A practical understanding of common web application vulnerabilities and how they are exploited
• Hands-on testing experience, whether professional or through labs, CTFs, coordinated bug bounty work or your own projects
• Familiarity with an interception proxy such as Burp Suite Community Edition or OWASP ZAP
• The ability to write up a finding clearly enough for a developer to reproduce it and fix it
• Sound ethical judgement, and a willingness to work only within the agreed scope
• Willingness to sign a confidentiality agreement and rules of engagement, and to complete a DBS check if required Desirable (a bonus rather than a checklist, and nobody has all of them)
• A relevant certification, or study towards one
• Experience testing modern JavaScript single-page applications and their APIs
• Experience reviewing cloud, database or build pipeline configuration
• Experience testing role-based or multi-tenant access control, or real-time session, messaging and file-sharing features
• Awareness of UK GDPR and the ICO Age Appropriate Design Code We are looking for someone who can give regular time, though we know availability varies from week to week. Testing works well in short, focused bursts, so we are happy to agree test windows around your availability. Remote What will you be doing? Ignite Hubs is currently developing an online platform that connects children and young people with tutors for one-to-one tutoring sessions. Because the platform puts adults and young people in direct contact and holds personal data about children, testing its security is as much safeguarding work as it is a technical exercise. Working alongside our CTO and developers, you would take on small, scoped pieces of testing across a modern single-page web application, its APIs and its cloud configuration, and write up what you find so the team can act on it. Typical pieces of work include
• Testing a feature or user journey, such as registration, tutor matching, booking or a live session, against the OWASP Top 10, or the APIs against the OWASP API Security Top 10
• Testing access control and account separation, so that a tutor can only reach the learners assigned to them and nobody uninvited can join or observe a one-to-one session
• Testing authentication, session handling and privilege boundaries between the different user roles the platform supports
• Reviewing cloud and platform configuration, such as database-level access controls, storage of material shared during sessions, and secrets handling
• Writing up findings clearly, with evidence and practical fixes, then re-testing once they are resolved Pieces of work are scoped to align with a volunteer's availability. You will not be on call, you will not carry sole responsibility for the platform's security, and nobody is expected to cover all of the above. How We Run Testing Safely Testing is carried out against non-production environments with synthetic data by default, and anything touching live systems is scoped and authorised in advance. Volunteers have no contact with young people, and are not given access to the personal data of real children and young people or to the content of real tutoring sessions.