Senior Penetration Tester (Gaming & Crypto)
We are looking for a Penetration and Security tester for a Casino project (per-project, part time)
Who are we?
Software Engineering company with expertise in FinTech and Blockchain. Strong software engineering culture. Fast development pace. We do things long-term. We build trust and relationships with employees and customers.
Required Skills
Gaming / Gambling Security
Experience testing online casino platforms
Experience testing lottery or raffle systems
Experience validating provably fair implementations
Understanding of RNG and cryptographic randomness
Ability to identify methods for manipulating game outcomes
Experience testing bonus abuse, referral abuse and promotional exploits
Experience identifying methods to bypass betting limits and wagering requirements
Responsibilities
The successful candidate will perform comprehensive security testing of two production-ready platforms prior to public launch.
Casino Platform Assessment
Attempt to exploit business logic flows that could allow players to:manipulate game outcomes;
abuse bonus systems;
bypass wagering requirements;
duplicate winnings;
manipulate balances;
bypass betting limits;
exploit race conditions during betting;
perform multiple withdrawals;
abuse promotions, referrals or loyalty programs
Test crypto and fiat wallet functionality including:deposits;
withdrawals;
transfers;
balance consistency;
concurrency handling;
transaction validation
Assess protections against automated bots, scripted abuse and account farming
Lottery Platform Assessment
Validate the integrity of the lottery draw process
Verify that the custom provably fair mechanism cannot be manipulated
Attempt to predict, influence or replay lottery outcomes
Test purchase workflows for duplicate purchases, payment manipulation and race conditions
Verify prize allocation logic for both cash and physical item rewards
Assess wallet integrity during ticket purchases, refunds and prize payouts
Test against abuse scenarios including:multiple simultaneous purchase requests;
replay attacks;
prize claim manipulation;
duplicate redemption;
account abuse;
automated purchasing bots.