Security and compliance testing for payment applications

Led manual QA and security testing for financial and payment products under central bank requirements, cutting repetitive effort 40% with reusable templates.

Client details are withheld under NDA. This case study describes the domain, the problem, and the approach only.

Context

Lead manual QA engineer for a team delivering financial and payment applications that had to meet Nepal Rastra Bank security requirements.

Problem

Each product went through similar functional and security checks, but the checks were rewritten per project. Coverage of injection, session handling, and access control was inconsistent, and audits took longer than they should.

Approach

Built a reusable set of test templates covering functional flows, OWASP Top 10 categories, SQL injection and XSS probes, and the specific regulatory checks. Ran security passes with Burp Suite and manual API probing. Trained junior engineers on the templates so the work did not depend on one person.

Outcome

Repetitive manual effort dropped by about 40%, and security coverage became consistent across products. The templates stayed in use after the engagement.

Tools

OWASP Top 10 checklists, Burp Suite
Postman for API probing
SQL for data validation
Jira for defect tracking