Dedicated penetration testers for your offshore team.
Offshore penetration testers in Chiang Mai and Bangkok, working full time on your product and managed by us. A penetration tester attacks your product the way a real attacker would, within a scope you approve, and shows you exactly what they could reach.
One fixed monthly fee. We employ the specialists, manage them day to day and keep their training current.
This role is part of a dedicated cybersecurity team. It's staff augmentation, fully managed: take one role on its own, or the whole area as one delivery team.
One Penetration Tester, assigned to your product and fully managed.
We assign a Penetration Tester to your team full time and run everything around them: a service delivery manager who oversees delivery, training and coaching, the office and equipment, and HR and payroll. The price below is for a junior Penetration Tester; other levels are priced in your proposal, and how the monthly fee is built explains the arithmetic.
From price
One junior Penetration Tester, full time, everything below included. All 27 things included ››
- Penetration tester From USD 2,700 per month
-
Service
We manage and develop the team
- A service delivery manager who oversees operations and delivery
- A 1:1 with our Head of Delivery every two weeks
- Weekly delivery scoring and monthly capacity reports
- A Talent Success Manager for every team member
-
HR
We are the employer
- Recruitment and technical assessment
- Employment contracts
- Salary and payroll
- Tax and social security
-
Facilitation
We provide the workplace
- A desk in our office in Chiang Mai or Bangkok
- A Workplace Experience Manager on site
- Team events through the year
- IT support
-
Equipment
We supply the tools
- Laptop and hardware
- Software licences
- LinkedIn Learning access
- Device security and management
What a Penetration Tester does on a dedicated cybersecurity team.
They test your staging and production systems within a written scope and report into your tracker. Every finding is retested once your own developers ship the fix.
Penetration Tester skills and technologies
-
Web application and API testing against the OWASP Top 10 and your product's own business logic.
-
Testing authentication, authorisation and tenant boundaries, where one user reaching another user's data does the most damage.
-
Infrastructure and cloud testing within an agreed scope, from exposed services to misconfigured storage.
-
Findings with steps to reproduce, a severity and a suggested fix, filed where your own developers work.
-
Retesting every fix, so a finding closes only once it is proven fixed.
Penetration Tester seniority levels.
Junior to senior. A tester who has seen many applications finds the business logic flaws that scanners miss. How deep the tests should go is a question of level, one of the inputs into how the monthly fee is built.
When your team needs a Penetration Tester.
Assigned when a product changes too often for a yearly test to keep up, or when enterprise customers ask for recent test evidence. Pairs with a security engineer who fixes the root causes the tests reveal, both within a dedicated cybersecurity team. It helps most where companies hire a dedicated development team and sell to customers with strict security reviews.
What we look for in a dedicated Penetration Tester.
We look for testers who go beyond the scanner. They understand how your product is meant to work and look for the ways it can be made to work differently. Clear written findings matter as much as finding the flaw.
A remote Penetration Tester's first three months on your team.
- Weeks 1 to 2Agreeing the scope and rules of engagement, and mapping your applications, APIs and exposed services.
- Weeks 3 to 6Running the first full test cycle and filing findings with steps to reproduce and suggested fixes.
- Months 2 to 3Retesting fixes, testing new releases as they ship and settling into a regular testing rhythm.
Questions about adding a Penetration Tester to your team.
Is regular penetration testing safe for production?
Yes, when it is planned. Every test runs inside a scope you approve in writing: which systems, which techniques, which hours and who to call if something looks wrong. Disruptive tests run against staging, and anything that touches production is scheduled with your team.
Can we get a report to share with our customers?
Yes. Alongside the working findings in your tracker, the tester writes a summary. It covers what was tested, what was found and what has been fixed and retested. Where a customer or auditor requires a test by an independent third party, our tester helps you prepare for that one too.
Add remote penetration testers to your team.
Tell us what is in scope, such as the web app, the APIs and the cloud setup, and how often you release. We'll suggest a testing rhythm and a tester profile, and send the fixed monthly fee. A service delivery manager can answer questions about scope first.
Tell us what your penetration tester would work on.
Loading the form…
We reply within one business day.
