Qa Automation Mid

VirtueTMS is a mobile-first Transportation Management System built for owner-operators and small trucking fleets, handling loads, documents, invoicing, and payment routing. Because the software moves money on behalf of carriers, correctness and security are core to the product, not polish items. The stack includes a Laravel 12 / PostgreSQL API, a Nuxt 3 / Vue 3 web app, and a React Native (Expo) mobile app; the product is pre-launch and in active build. We are looking for a QA Automation Engineer to build the automated testing foundation that lets the team ship safely and quickly.

Core Responsibilities

• Build an automated test suite that runs on every change, so regressions are caught before they ship.
• Verify the core money loop end-to-end (sign up → load → capture documents → invoice → get paid) using known, repeatable test data.
• Probe the security of a multi-tenant system where one carrier must never be able to see or touch another carrier's data.
• Stand up and own a shared, seeded test environment that the whole team can rely on.

Qualifications:

• Experience: Proven experience building and maintaining automated test suites (end-to-end, integration, and regression), not just writing manual test cases.
• Hands-on with a modern browser automation framework — Playwright or Cypress — for testing web applications.
• Experience testing REST APIs directly (e.g., Postman/Newman, or code-based API test suites).
• Comfortable integrating automated tests into a CI pipeline (GitLab CI) so they run automatically on every change.
• Demonstrated mobile app testing experience on both iOS and Android — real devices and emulators/simulators.
• Familiar with mobile test distribution and cycles (e.g., TestFlight, Play internal testing) and mobile-specific issues: offline/poor-connectivity behavior, permissions, camera/photo capture, push notifications. Mobile is the priority surface for this product, and this experience is weighted heavily.
• Practical experience testing for common web/API vulnerabilities (OWASP Top 10): injection, broken access control, authentication flaws.
• Specifically: experience testing multi-tenant access control / authorization boundaries — confirming one account cannot access another account's data (IDOR / broken object-level authorization). This is the single most important security concern for this product.
• Comfortable using security testing tooling (e.g., Burp Suite, OWASP ZAP) to probe an API.