Detection correctness
Rules and models tested against replayed attack traces and benign noise, tracking false positives and misses.
CYBERSECURITY · 305 OPEN ROLES
QA for cybersecurity
Security vendors ship software that customers trust with their defences. QA here means testing the product like an attacker would, plus correctness of detections, performance under noisy telemetry and safe behaviour when something fails.
Reply within one working day. NDA before we see your backlog. Shortlist in about 4 working days.
What we test
What we test in cybersecurity.
The risks that matter most in this industry, and the checks we put in place for each. Engineers are matched on these, not only on tool names.
Agent and platform safety
Endpoint agents tested so an update or crash does not disrupt the hosts they protect.
Offensive testing
Web, API and infrastructure testing by people who think like attackers.
Scale and telemetry
Ingest pipelines tested at the event rates of the largest customers.
Typical roles
All QA roles
The roles cybersecurity teams hire.
Each role links to the hiring page and to the role guide. Pay shown is the US median for mid-level, gross per year.
Security / Penetration Tester
Attacker-style testing of the product.
SDET
Harnesses for agents, detections and pipelines.
Performance Test Engineer
Event-rate and storage load.
QA Automation Engineer
Console and workflow regression.
Release / DevOps Engineer
Safe, staged update rollout.
Another role?
We staff 15 QA roles in every industry. Tell us the one you need and the stack it runs on.
All QA roles
Tooling
The stack our cybersecurity engineers work in.
Tools common in cybersecurity QA. We staff against your stack, so this list is a starting point and not a limit.
Burp SuiteSecurityOWASP ZAPSecurityPythonLanguageDockerInfrastructurek6PerformanceGitHub ActionsCI/CD
Each tool page shows demand, pay and a learning path. Licences stay in your name.
Compliance considerations
What shapes cybersecurity testing.
These standards describe obligations that usually apply to the product or the client. PassRidge does not hold them on your behalf and nothing here is legal advice. Your compliance owner sets the scope.
01
OWASP ASVS and Top 10
Standard requirements and weakness lists used to structure application security testing.
02
ISO/IEC 27001 and SOC 2
Customers expect a vendor to hold or demonstrate the controls.
03
Common Criteria (ISO/IEC 15408) and FIPS 140-3
Certification routes for security products and cryptographic modules, needed for some government sales.
04
FedRAMP
US government authorisation for cloud services, with continuous-testing requirements.
Our engineers work inside your controls, on masked or synthetic data, and produce test evidence in the format your reviewers ask for. How security works in every engagement.
Engagement model
Compare all five
Why QA staff augmentation fits cybersecurity.
Specialist testers join the vendor's team under their lead for a release or an audit. It is a starting recommendation: all five models are available for cybersecurity work.
QA staff augmentation
Add vetted QA engineers to your team, under your management.
Dedicated QA team
A stable QA squad that works only on your product.
Project-based testing
Fixed scope, fixed price: a release tested, an app audited.
Managed QA (QAaaS)
We run QA end to end and report against agreed SLAs.
Open roles
View all 305
Recent cybersecurity QA roles.
Real listings with pay shown. Looking for a job in this industry? Browse them all.
Permanenttoday
QA Team Lead - Cyber & AI
₪460k–560k / year · est.
Cybersecurity company · Tel Aviv · On-site
PlaywrightPostmanJenkins
Permanenttoday
Helpdesk Automation Engineer
$95k–140k / year
Cybersecurity company · New York · On-site
PlaywrightSeleniumCypress
Permanenttoday
QA Analyst/Test Script Writer
$100k–120k / year
Cybersecurity company · McLean · Hybrid
Jira
FAQ
QA for cybersecurity: your questions.
Do your security testers hold certifications?
Many hold recognised offensive-security qualifications. We list them on the profile and verify them before an introduction.
Can you test our product without seeing source code?
Yes. Black-box, grey-box and white-box tests are all possible. Tell us what access you want to give, and we scope accordingly.
How do you protect vulnerabilities we find?
Findings go only to the named contacts in the rules of engagement, through your channel, under NDA. We retain nothing after the engagement.
Which engagement model do you recommend for cybersecurity?
Usually qa staff augmentation. Specialist testers join the vendor's team under their lead for a release or an audit. QA staff augmentation starts in about 10 days, mid-level rates begin at $38 an hour and the minimum term is 3 months. The five models are compared at /outsourcing/.
Hire for cybersecurity
Tell us what you test. We reply in one working day.
Send the product, the stack and the release cadence. An engagement manager answers with a team outline, a recommended model and a price range.
Other industries
All ten
478 open roles
Fintech
Payments, lending and trading platforms where a wrong decimal is an incident.
QA for fintech 46 open rolesBanking & Insurance
Core-banking migrations, regulated releases and long regression cycles.
QA for banking and insurance 344 open rolesHealthcare / MedTech
Clinical software, device firmware and audit-ready test evidence.
QA for healthcare and MedTech