Consultancy for Independent Security Assessment and Penetration Testing of the Government-Private Sector Forum Management Information System (G-PSF MIS)
- Career Category: Consultancies
- Location: Phnom Penh
Summary
Beneficiary Institution: Council for the Development of Cambodia (CDC)
Assignment Type: Short-term Consultancy
Assignment Location: Cambodia / Remote
Objectives of the Assignment
The overall objective is to independently assess the security posture of the G-PSF MIS Web and Mobile Applications and their supporting backend services to ensure that significant security vulnerabilities are identified and addressed before production deployment.
The specific objectives are to:
- Identify and evaluate security vulnerabilities affecting the G-PSF MIS Web Application, Mobile Application, and associated APIs.
- Assess the effectiveness of authentication, authorisation, session management, and role-based access controls.
- Evaluate potential security weaknesses that could result in unauthorised access, data leakage, data manipulation, privilege escalation, or system compromise.
- Assess the security of sensitive information handling, including transmission, storage, and access restrictions.
- Examine the security of interactions between application components and backend services.
- Assess the application security configuration and relevant deployment controls within the agreed testing boundary.
- Provide clear, technically justified, and prioritised recommendations for addressing identified vulnerabilities.
- Conduct verification testing after DCx has implemented corrective actions.
- Produce an independent security assessment report to support system readiness and stakeholder acceptance.
Scope of Work
The selected consultant or company shall perform a comprehensive penetration test covering both application components and supporting backend services.
- Web Application Penetration Testing
- Mobile Application Penetration Testing
- Backend API and Server-Side Security Testing
Please click the attachment below for more information.
Eligibility
- Individual Consultant Requirements
- Applicants applying as individuals should meet the following criteria:
- A Master's degree in Cybersecurity, Computer Science, Information Technology, Software Engineering, or a related field, or equivalent demonstrated professional competence.
- At least 5 years of relevant professional experience in penetration testing, application security assessment, or ethical hacking.
- Demonstrated experience conducting security testing of Web Applications and APIs.
- Practical experience in Mobile Application security testing for Android and/or iOS.
- Good understanding of authentication, session management, access control, API security, and common application vulnerabilities.
- Experience applying OWASP security testing methodologies.
- Ability to prepare professional penetration testing reports with clear technical findings and corrective recommendations.
- Strong communication skills and ability to coordinate with software development teams.
- Relevant professional certifications are an advantage, including:
- Offensive Security Certified Professional (OSCP).
- Offensive Security Web Expert (OSWE).
- CREST penetration testing certifications.
- Practical Network Penetration Tester (PNPT).
- GIAC penetration testing or application security certifications.
- Other recognised equivalent certifications.
- Certification is desirable but not mandatory where the applicant can demonstrate substantial relevant technical experience.
- Company Requirements
- Companies applying for this assignment should meet the following criteria:
- Valid business registration and appropriate authorisation to provide cybersecurity or ICT professional services.
- At least 5 years of demonstrated experience in cybersecurity, penetration testing, or related security assessment services.
- Proven experience in Web Application, Mobile Application, and API security assessment.
- Availability of qualified security professionals capable of completing the assignment.
- At least one designated Penetration Testing Lead responsible for technical execution, quality assurance, reporting, and communication.
- Experience providing similar services to government institutions, development projects, financial institutions, or enterprise information systems is an advantage.
- Ability to provide sample security assessment reports with confidential information removed.
- The nominated Penetration Testing Lead should satisfy the core technical competency requirements expected of an individual consultant.
- Independence and Conflict of Interest
- The selected individual or company must be independent of the G-PSF MIS development and implementation activities being assessed.
- Applicants must disclose any existing or potential conflict of interest, including any prior involvement in developing, reviewing, or implementing the application components covered by the assignment.
- DCx reserves the right to determine whether a disclosed conflict affects an applicant's eligibility or the independence of the assessment.
