Ignite Hubs
Security & Penetration Testing - Volunteer
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Help keep an online one-to-one tutoring platform for children and young people safe
Join our Agile product team as a volunteer security tester, probe the application and its APIs, and help us fix what you find. Open to testers with at least 3 years experience.
What difference will you make?
Play a vital role in helping Ignite Hubs deliver high-quality, inclusive tutoring to children and young people who need it most. We work particularly with girls, those from disadvantaged backgrounds, and those from underrepresented backgrounds. Your contribution protects the young people who use the platform and the data they trust us with, and gives schools, parents, carers and funders the confidence that it is safe to use.
What are we looking for?
What qualities and experience should your volunteer have?
Essential
- A practical understanding of common web application vulnerabilities and how they are exploited
- Hands-on testing experience, whether professional or through labs, CTFs, coordinated bug bounty work or your own projects
- Familiarity with an interception proxy such as Burp Suite Community Edition or OWASP ZAP
- The ability to write up a finding clearly enough for a developer to reproduce it and fix it
- Sound ethical judgement, and a willingness to work only within the agreed scope
- Willingness to sign a confidentiality agreement and rules of engagement, and to complete a DBS check if required
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Desirable (a bonus rather than a checklist, and nobody has all of them)
- A relevant certification, or study towards one
- Experience testing modern JavaScript single-page applications and their APIs
- Experience reviewing cloud, database or build pipeline configuration
- Experience testing role-based or multi-tenant access control, or real-time session, messaging and file-sharing features
- Awareness of UK GDPR and the ICO Age Appropriate Design Code
We are looking for someone who can give regular time, though we know availability varies from week to week. Testing works well in short, focused bursts, so we are happy to agree test windows around your availability.
Remote
What will you be doing?
Ignite Hubs is currently developing an online platform that connects children and young people with tutors for one-to-one tutoring sessions. Because the platform puts adults and young people in direct contact and holds personal data about children, testing its security is as much safeguarding work as it is a technical exercise.
Working alongside our CTO and developers, you would take on small, scoped pieces of testing across a modern single-page web application, its APIs and its cloud configuration, and write up what you find so the team can act on it. Typical pieces of work include
Get help with your application
Your very own career expert that helps elevate your application to the next level.
- Testing a feature or user journey, such as registration, tutor matching, booking or a live session, against the OWASP Top 10, or the APIs against the OWASP API Security Top 10
- Testing access control and account separation, so that a tutor can only reach the learners assigned to them and nobody uninvited can join or observe a one-to-one session
- Testing authentication, session handling and privilege boundaries between the different user roles the platform supports
- Reviewing cloud and platform configuration, such as database-level access controls, storage of material shared during sessions, and secrets handling
- Writing up findings clearly, with evidence and practical fixes, then re-testing once they are resolved
Pieces of work are scoped to align with a volunteer’s availability. You will not be on call, you will not carry sole responsibility for the platform’s security, and nobody is expected to cover all of the above.
How We Run Testing Safely
Testing is carried out against non-production environments with synthetic data by default, and anything touching live systems is scoped and authorised in advance. Volunteers have no contact with young people, and are not given access to the personal data of real children and young people or to the content of real tutoring sessions.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location