滲透測試顧問（Freelance／項目合約）

科擎科技有限公司（iGears）自2004年起為香港機構開發軟件，現正為客戶的滲透測試項目招募Freelance顧問。以項目形式合作，按議定日薪計算，主要遙距工作，間中需要到香港客戶現場。工作包括網頁應用程式、API及流動應用程式的滲透測試、撰寫報告及複測。申請人須持有OSCP或同等認證，並具最少兩年實際滲透測試經驗。亦歡迎有興趣以兼職僱員形式合作的人士申請。

About iGears

iGears Technology Limited (科擎科技有限公司) has built software for Hong Kong organisations since 2004, including listed companies, public-sector bodies, NGOs, education organisations and churches. We develop and run 20 of our own SaaS products, and our MobPage division has published 200+ mobile apps. With offices in Hong Kong and Edmonton, Canada, we are now building an in-house cybersecurity team to deliver penetration testing, security risk assessments and privacy impact assessments for clients, and to secure our own platforms.

How we work together

Independent contractor, paid per engagement at an agreed day rate. Engagements run from a few days to about four weeks, mostly remote, with occasional on-site work in Hong Kong. You choose which engagements to take. If you would prefer regular part-time employment instead, tell us in your application and we will discuss an employment contract.

What you’ll do

• Run penetration tests of web applications, APIs and mobile apps for iGears’ clients in Hong Kong and Canada, following OWASP WSTG, ASVS and MASVS
• Verify every finding by hand, rate risk with CVSS, and write clear reports in iGears’ report template
• Retest fixes and support verification letters
• Work within each engagement’s written authorisation, rules of engagement and testing window

What you’ll bring

• OSCP, or an equivalent hands-on certification (e.g. CREST CRT or CCT, GIAC GPEN or GWAPT, eWPTX, PNPT)
• At least 2 years of hands-on penetration testing, with web application and API testing as core skills
• Your own testing laptop and licensed tools (e.g. Burp Suite Professional)
• Able to invoice iGears as a business (e.g. with a Hong Kong Business Registration Certificate)
• The right to work and do business in Hong Kong
• Willing to sign an NDA and our rules of engagement, and to complete a background check where a client requires it

Nice to have

• OSWE, OSEP, BSCP or CREST CCT APP
• Mobile (iOS/Android), Active Directory or cloud (AWS, Azure, GCP) testing
• Source code review
• Your own professional indemnity insurance
• Spoken Cantonese, for working with Hong Kong clients

What we offer

• Paid per engagement at an agreed day rate
• Client projects in Hong Kong and Canada, plus testing of our own 20 SaaS products
• Flexible: you choose which engagements to take
• Part-time employment possible if you prefer it

Explore our platforms before you apply

• AI: GenCMS (gen-cms.com), AskCore (askcore.org), HumanLevelUP (humanlevelup.org), PromoPilot (promo-pilot.org), Webetter (webetter.co), PhotoCen (photocen.com), Duckbot (duckbot.hk, preview)
• Business operations: fileEC (fileec.com), InsightBook (insightbook.org), HRFlowTech (hrflowtech.com), MemberSys (membersys.org), AppointSys (appointsys.org), Paperless.Cards (paperless.cards)
• Messaging and marketing: SendPromotion.Email (sendpromotion.email), SendSMS.click (sendsms.click), MarketHK (markethk.net)
• Education and community: LearnSys (learnsys.org), ITChurch (itchurch.online)
• Directories: E12 (e12.hk, e12.ca) and E12 Careers (jobs.e12.hk, jobs.e12.ca)

Full list: https://www.igears.com.hk/platforms/

How to apply

Email [email protected] with the subject “Freelance PT – Your Name”. Please include your CV, links to or IDs for your certifications, your day rate in HKD, your availability (days per month), and a redacted sample report if you have one.

iGears welcomes applications from all qualified candidates.

Personal data you provide will be used by iGears Technology Limited only for recruitment. Providing it is voluntary, but we can’t consider your application without it. It may be shared with other iGears offices if you are considered for a role there. Data of unsuccessful applicants is destroyed within two years. To access or correct your data, or for our full Personal Information Collection Statement, email [email protected].

申請人提供的個人資料只會用作招聘用途。不獲取錄申請人的資料將於兩年內銷毀。如需查閱或更正個人資料，或索取完整的收集個人資料聲明，請電郵至[email protected]。

https://e12.hk/pages/company.php?slug=igears-technology-limited

iGears Technology Limited (科擎科技有限公司) has built software for Hong Kong organisations since 2004, including listed companies, public-sector bodies, NGOs, education organisations and churches. We develop and run 20 of our own SaaS products, and our MobPage division has published 200+ mobile apps. With offices in Hong Kong and Edmonton, Canada, we are now building an in-house cybersecurity team to deliver penetration testing, security risk assessments and privacy impact assessments for clients, and to secure our own platforms.