AWS Medical Software Application Penetration Testing

We need an independent penetration tester to perform a formal system-level penetration test of an AWS-hosted medical software application.

Environment includes:

AWS EC2 running Windows Server
IIS/ARR
Authenticated HTTPS API
Amazon Cognito / OAuth 2.0 / JWT authentication
DICOM image processing
Internal application services

Required testing should include:

Web application and API penetration testing
Authentication and authorization testing
Cognito/JWT testing
Network and cloud security testing
Windows/IIS configuration review
Malformed and oversized input testing
Privilege escalation and sensitive-data exposure testing
Resource-exhaustion / availability testing
Vulnerability chaining
Remediation validation and retesting

Deliverable must be a professional penetration-test report suitable for use in regulated medical-device cybersecurity documentation, including:

Tester qualifications and independence
Test dates
Tested build/environment
Scope and exclusions
Methodology and tools
Findings by severity
Evidence
Remediation recommendations
Retest results
Final disposition

Experience with AWS, APIs, Windows Server/IIS, OAuth/JWT, and regulated environments is strongly preferred. OSCP, CISSP, GPEN, or similar credentials are a plus.

Please include relevant penetration-testing experience, certifications, sample report format if available, estimated cost, and turnaround time.

***REQUIRED - Will need to submit resume if interested. Thank you.