Nucleus Labs

Project Context

Our client is building and maintaining software systems where reliability, data protection, and secure user flows are critical. The QA function is not limited to checking whether features work as expected. The team also needs someone who can actively challenge the system, identify weak points, verify security assumptions, and help prevent vulnerabilities before they reach production.

We are looking for an Ethical Hacker / Penetration Tester who can work closely with QA (or as a part time QA), engineering, and product teams to test web applications, APIs, authentication flows, permissions, infrastructure exposure, and overall application security.

This is a hands-on role. The main expectation is to find real risks, reproduce them clearly, document them properly, and help the engineering team validate that fixes are effective.

Role

We are looking for a Security QA Engineer / Ethical Hacker / Penetration Tester who will take ownership of security testing across application, API, and platform layers.

This person should be comfortable working as part of a QA-oriented delivery process while bringing deeper security expertise into the team. The role requires practical knowledge of penetration testing, vulnerability assessment, secure testing methods, and clear communication with developers.

Key Responsibilities

• Perform manual security testing of web applications, APIs, user flows, and admin panels.
• Conduct penetration testing against staging and production-like environments.
• Identify, reproduce, document, and validate security vulnerabilities.
• Test authentication, authorization, permissions, session management, password flows, and access-control logic.
• Review API endpoints for broken access control, injection risks, data exposure, rate-limit issues, and insecure design.
• Validate security fixes and perform regression security testing.
• Work with QA engineers to include security checks in the regular testing process.
• Prepare clear reports with reproduction steps, evidence, severity, impact, and recommended remediation.
• Collaborate with developers to explain vulnerabilities and verify that fixes address the real issue.
• Support threat modeling and security review of new features when needed.
• Help improve security awareness and testing standards inside the team.

Required Experience

• 3+ years of experience in penetration testing, application security, security QA, or ethical hacking.
• Strong understanding of OWASP Top 10 and common web application vulnerabilities.
• Experience testing REST APIs and web-based systems.
• Practical experience with authentication and authorization testing.
• Ability to discover, reproduce, and explain vulnerabilities clearly.
• Experience using security testing tools such as Burp Suite, OWASP ZAP, Nmap, Wireshark, Metasploit, or similar.
• Understanding of HTTP, HTTPS, cookies, headers, sessions, JWT, OAuth2, MFA, and role-based access control.
• Ability to write simple scripts or proof-of-concept checks when needed, preferably in Python.
• Strong documentation skills and ability to produce actionable vulnerability reports.
• Good communication skills and ability to work directly with engineering and QA teams.
• Upper-intermediate or better English for written and spoken communication.

Nice to Have

• Experience with cloud security testing, especially AWS, Azure, or GCP.
• Experience with Docker, Kubernetes, CI/CD pipelines, and infrastructure security basics.
• Experience with mobile application security testing.
• Experience with secure code review.
• Experience with SAST, DAST, dependency scanning, and security automation.
• Bug bounty experience or responsible disclosure background.
• Security certifications such as OSCP, PNPT, eJPT, CEH, GWAPT, or similar.
• Experience working in product teams rather than only external consulting environments.

What Success Looks Like

• Security issues are found early and described clearly.
• Developers can reproduce and fix reported vulnerabilities without confusion.
• QA coverage becomes stronger because security checks are included in regular delivery.
• Authentication, authorization, and API risks are actively tested before release.
• Security findings are prioritized by real impact, not just tool output.
• The team gains practical confidence that critical user flows and sensitive data are protected.

Our client is a US-based remote-online-learning provider serving students through live digital instruction and operational student-support workflows. Together with Nucleus AI, the client is building the CCA Wellness Check Compliance Platform — a focused internal system for recording, tracking, and proving weekly student wellness checks.

The platform is designed to solve a concrete compliance and operations problem: the school needs a reliable way to confirm that weekly student wellness checks happened, maintain an auditable record, identify students who were not seen, and support escalation workflows when follow-up is required.

The MVP is time-sensitive and must be production-ready before the August teacher training window and September operational launch.

You’ll join a delivery team building a practical compliance platform from the ground up, working closely with product, engineering, QA, delivery, and client stakeholders.

Responsibilities

Fullstack Product Development

• Build and maintain end-to-end product features across backend services and frontend application layers.
• Work with frontend frameworks such as React, Angular, or Blazor to deliver user-facing functionality.
• Integrate frontend applications with backend APIs and ensure smooth client-server communication.
• Debug issues across the full application stack, including frontend behavior, API contracts, backend logic, database interactions, and deployment environments.
• Collaborate with product, design, frontend, backend, and AI/ML teams to translate requirements into working product features.
• Ensure frontend and backend changes are aligned, tested, and production-ready.

Backend Development & Architecture

• Design and build scalable backend services using .NET Core / .NET Framework.
• Develop RESTful APIs and microservices using ASP.NET Core.
• Apply clean architecture principles and enforce coding standards.
• Ensure systems are performant, secure, and maintainable.

Cloud & Infrastructure

• Build and operate services on Microsoft Azure, including App Services, Functions, Azure SQL, and AKS.
• Implement CI/CD pipelines using Azure DevOps or GitHub Actions.
• Work with containerized environments such as Docker and Kubernetes.
• Ensure system reliability, monitoring, and disaster recovery strategies.

Code Quality & Performance

• Conduct code reviews and enforce best practices across backend and frontend codebases.
• Implement unit, integration, and end-to-end testing where appropriate.
• Monitor, profile, and optimize system performance across application layers.

Security & Compliance

• Implement secure authentication and authorization using OAuth, JWT, or similar approaches.
• Follow OWASP best practices.
• Ensure data protection and system integrity.

Documentation & Improvement

• Document technical decisions, API contracts, system behavior, and development workflows.
• Continuously improve system design and development workflows.
• Stay current with .NET, frontend, and cloud ecosystem developments.

Requirements

• 5+ years of professional engineering experience, with strong commercial experience in .NET / C#.
• Strong experience with ASP.NET Core, Web API, Entity Framework, and SQL Server.
• Hands-on frontend experience with React, Angular, Blazor, or a comparable modern frontend framework.
• Ability to build fullstack features from database and backend logic through API design and frontend implementation.
• Experience integrating frontend applications with REST APIs and debugging client-server issues.
• Hands-on experience with Microsoft Azure.
• Experience with CI/CD pipelines and Git.
• Experience with Docker and Kubernetes.
• Strong understanding of SDLC, SOLID, and design patterns.
• Experience with unit testing frameworks such as xUnit, NUnit, or MSTest.
• Ability to debug and resolve complex issues across the full application stack.
• Strong communication skills and ability to work closely with cross-functional teams.
   

Nice to Have

• Experience with React or AngularJS.
• Experience with messaging systems such as RabbitMQ, Kafka, or Azure Service Bus.
• Familiarity with NoSQL databases such as Cosmos DB or MongoDB.
• Azure certifications.
• Experience in LMS, edtech, legal-tech, fintech, or data-heavy platforms.
• Experience working with AI-assisted systems, AI/ML integrations, or data-driven product features.

What Matters for This Role

• Ownership mindset — ability to take responsibility for features and systems end-to-end.
• Strong backend engineering foundation combined with practical frontend delivery skills.
• Comfort working in ambiguous, fast-moving environments.
• Strong engineering judgment and pragmatic decision-making.
• Ability to collaborate across backend, frontend, cloud, product, and AI/ML teams.

We're looking for a hands-on Fullstack QA Engineer who can operate comfortably as a manual tester and build/maintain automated suites using modern agentic AI practices to deliver fast, reliable regression and release confidence.

You'll collaborate closely with Product, BA, Engineering, and stakeholders, shaping test strategy, hardening quality gates, and improving confidence in complex data-heavy workflows.

Responsibilities

Test Strategy & Planning

• Translate requirements and acceptance criteria into risk-based test plans and coverage maps across UI, API, data, reports, formulas, and integrations.
• Define and evolve a pragmatic test pyramid: unit, API, UI, smoke/sanity, regression, and UAT.
• Create coverage around spreadsheet-driven validation, report parity, and key billing / reconciliation workflows.

Manual Testing

• Create and execute test cases for new features, bug fixes, report logic, filter combinations, and change requests.
• Perform exploratory testing to uncover edge cases in data-heavy workflows, calculations, and stakeholder-facing panels.
• Validate generated outputs against canonical XLSX workbooks, including formulas, filters, totals, and rollforward variance logic.
• Log high-quality defects with clear reproduction steps, impact, evidence, screenshots, and expected vs actual results.

Test Automation (agentic-AI-first)

• Build and maintain stable, reusable automated suites for smoke and regression using modern agentic AI practices.
• Help reduce slow manual spreadsheet comparison by contributing to automated parity checks and repeatable QA flows.
• Integrate automation into CI/CD with environment tagging, parallelization, and results gating.
• Expand coverage to API, data validation, and key business workflows.

Quality Operations

• Own test data management and environment readiness.
• Track and report quality KPIs such as defect escape rate, flaky test rate, regression coverage, and cycle time to fix.
• Maintain living documentation, including test plans, suites, runbooks, and QA reports.

Collaboration & Process

• Partner with Product and BA to clarify acceptance criteria and reduce ambiguity in stakeholder requirements.
• Participate in backlog grooming, design reviews, release readiness, and stakeholder review cycles.
• Coach teammates on writing testable stories and preventing regressions.
• Continuously improve test effectiveness and reduce manual repetition.

Requirements

• 4–6+ years of QA experience testing SaaS / web applications, including significant hands-on manual testing.
• 2+ years building and maintaining automation for UI and/or API — ideally using modern agentic AI practices and/or tools like Playwright, Cypress, Selenium, or Postman.
• Strong grasp of testing methodologies: functional, regression, smoke/sanity, exploratory, risk-based testing, and test case design.
• Experience validating data-heavy applications, reports, dashboards, formulas, filters, and spreadsheet-like business logic.
• Experience with bug tracking and test management tools such as Jira, TestRail, or Zephyr.
• Comfortable with browser devtools, basic SQL, logs, and evidence-based debugging.
• Clear communicator with a strong bias for reproducibility, documentation, and practical delivery.
• Familiarity with Agile practices and fast-paced iterative delivery.

Nice to Have

• Power-user experience with modern agentic AI practices for QA: prompt design, evaluation harnesses, data sets, custom functions, CI artifacts, and reporting dashboards.
• Experience building automated parity checks for spreadsheets, reports, financial calculations, or analytics dashboards.
• API testing depth with tools such as Postman, Insomnia, or newman.
• Exposure to regulated healthcare environments, HIPAA-aware workflows, PHI handling, audit discipline, and documentation rigor.
• Basic performance, reliability, and accessibility testing experience.
• Experience testing analytics, reconciliation, billing, finance, revenue operations, or healthcare operations systems.

Project

Our client is building an analytics and reconciliation platform for a multi-facility radiology billing operation. The system surfaces scan volume, revenue, declining referrals, unbilled MRIs, and rollforward variance for finance and operations teams.

The work is focused on documentation tracking, operational analytics, billing reconciliation, and report accuracy. The current goal is MVP implementation, with several UI components already completed and a strong need to improve QA around spreadsheet-driven reporting logic.

The project operates in a healthcare-adjacent regulated environment. 

Role Overview
We are looking for a highly capable Full Stack Engineer with deep experience in Python and React who is also very comfortable with harness engineering—building the surrounding tooling, automation, testing scaffolding, execution environments, and orchestration layers that allow systems, agents, workflows, and product features to be developed, validated, and run reliably at scale.

This role is ideal for an engineer who can move fluidly between backend services, frontend product development, automation frameworks, integration layers, and developer tooling. You should be equally comfortable shipping user-facing features and building the technical harnesses that make systems testable, observable, repeatable, and production-ready.

Key Responsibilities

• Build and maintain full stack applications using Python on the backend and React on the frontend.
• Design and implement APIs, services, and orchestration layers for product workflows and internal tools.
• Develop harnesses for testing, simulation, validation, execution, and monitoring of complex workflows, agents, or integrations.
• Create reusable frameworks for:
  • workflow execution
  • automated test runs
  • sandboxed environments
  • synthetic data generation
  • scenario replay
  • regression validation
• Build developer-facing tools to improve engineering velocity, quality, and repeatability.
• Integrate external services, APIs, and third-party tools into internal platforms.
• Implement logging, tracing, observability, and error-handling across systems.
• Collaborate with product, design, and platform stakeholders to turn business needs into scalable technical solutions.
• Help define engineering standards for reliability, maintainability, and deployment readiness.

Required Qualifications

• Strong hands-on experience building production systems with Python.
• Strong hands-on experience building modern frontend applications with React.
• Experience designing and consuming REST APIs and/or async service architectures.
• Experience with harness engineering, including building tooling for testing, validation, simulation, automation, or execution environments.
• Comfortable working across both application code and engineering infrastructure/tooling.
• Strong understanding of software design, debugging, and performance optimization.
• Experience with databases such as PostgreSQL, MySQL, or similar.
• Familiarity with CI/CD pipelines, Git-based workflows, and deployment practices.
• Ability to work independently, move quickly, and make sound engineering tradeoffs.

Preferred Qualifications

• Experience with workflow orchestration, agent-based systems, or automation pipelines.
• Experience with Docker, cloud infrastructure, and containerized environments.
• Familiarity with background job systems, queues, and event-driven architectures.
• Experience building internal platforms, QA tooling, evaluation frameworks, or developer productivity tools.
• Exposure to LLM/AI workflow orchestration, RPA, or test automation systems.
• Experience with observability tools, telemetry, and production monitoring.

What Success Looks Like

• You can ship polished frontend and backend features end-to-end.
• You can build robust harnesses that make systems easier to test, measure, debug, and scale.
• You improve both product delivery and engineering leverage.
• You help the team move faster by making complex workflows repeatable and reliable.

Ideal Candidate Profile
You are not just a feature engineer. You think in systems. You naturally ask:

• How do we test this?
• How do we simulate this?
• How do we validate edge cases?
• How do we make this reproducible?
• How do we instrument this so we can trust it in production?

You enjoy building the “glue,” scaffolding, and runtime support that turn promising ideas into dependable products.