Quality Assurance (QA) Engineer

OneAsset is a regulated Real-World Asset (RWA) platform built for compliant on-chain tokenisation, yield distribution, secondary trading, and governance of real estate and private assets.

Our platform is a modular, state-driven system operating under strict institutional requirements for correctness, auditability, and regulatory clarity. At OneAsset, execution quality is a core security and reliability function—not a downstream checkpoint.

Role Overview

We are seeking a self-directed, investigative QA Engineer to own quality end-to-end across our MVP and post-MVP releases.

This is not a superficial UI testing role, nor a position for someone who simply clicks through "happy paths." We are looking for an engineer who digs underneath the UI to test APIs, probe auth logic, verify data integrity, and ask: "What happens if I send this unexpected payload instead?"

The AI-First Advantage

At OneAsset, we view modern AI tools as a core force multiplier. We expect our QA Engineer to aggressively leverage AI (LLMs, automated test generators, prompt engineering) to auto-generate edge-case vectors, scaffold complex test scripts, analyze database state integrity, and audit OpenAPI specs—enabling you to deliver the depth and speed of a multi-person team.

Key Responsibilities

1. AI-Augmented Edge-Case & Non-Happy Path Testing

• Utilise AI workflows and LLMs to rapidly brainstorm, model, and generate negative-path test matrices and edge-case vectors that humans often miss.

• Validate failure scenarios: KYC/KYB expirations, restricted actions, partial network failures, timeouts, and delayed/withheld settlements or yields.

• Identify undefined or ambiguous system behavior early and escalate directly to Product and Engineering.

2. Deep API & Backend Probing

• Interrogate endpoints directly via Postman, curl, and REST; read and validate Swagger/OpenAPI specifications.

• Verify request/response contracts, input validation, and boundary conditions that the UI never exposes.

• Leverage AI to generate complex API test payloads and auto-generate script templates for automated edge-case validation.

3. Auth & Access Control (Security Focus)

• Probe Privy authentication and embedded wallet flows end-to-end for resilience and correctness.

• Perform hands-on testing for Broken Object-Level Authorisation (BOLA/IDOR) vulnerabilities to ensure complete data isolation across roles and sessions.

4. Data Correctness & Integrity

• Ensure complete consistency between what the UI presents, what the backend processes, and what exists at the database/on-chain level.

• Query databases (SQL) directly to perform state-transition validations post-migration and post-transaction.

5. End-to-End Ownership & Release Gatekeeping

• Define the test strategy, scope, and depth completely autonomously—no hand-holding or pre-written scripts required.

• Maintain structured, reusable test artifacts (scenario matrices, risk registers) designed for release validation and regulatory audit support.

• Provide definitive go / no-go input for releases based on risk and functional readiness.

Experience & Skills Required

Must-Have

• 3–6+ years in a QA or software testing role focused on complex, state-driven, or workflow-heavy applications.

• Demonstrated AI Proficiency: Proven experience leveraging AI tools (e.g., ChatGPT, Claude, GitHub Copilot, or specialised AI testing suites) to accelerate test design, script writing, and risk analysis.

• Backend & API Mastery: Fluency with Postman, curl, REST principles, HTTP semantics, and OpenAPI/Swagger documentation.

• Database & Data Validation: Proficiency writing SQL queries to verify backend state and data integrity.

• Autonomous Mindset: You take complete ownership of product quality, probing deep into edge cases rather than waiting for a ticket or a script.

Strong Plus

• Experience in fintech, Web3, DeFi, or tokenized asset platforms.

• Familiarity with wallet-based or embedded-wallet auth systems (e.g., Privy).

• Exposure to blockchain state verification (on-chain vs. off-chain data consistency).

• Test automation experience (JavaScript/TypeScript, Python, or similar).

• Prior experience working within regulated environments (e.g., DFSA, VARA, FCA).

KPIs & Success Metrics

• Zero Critical Undiscovered Defects: MVP and mainnet releases contain no critical functional, auth, or data-integrity bugs in production.

• AI Efficiency Multiplier: Measurable speed and depth in test coverage through AI tool utilisation.

• Proactive Bug Discovery: High-severity auth, state, and API edge-case defects caught during early staging rather than post-release.

• Quality Signal Trust: Product and Engineering teams rely on QA risk registers as a definitive release gate.