Senior Penetration Tester

We are seeking a Senior Lead Penetration Tester to support an upcoming client engagement involving external network, web application, and security assessment activities. This is a fixed-price project with the potential for recurring quarterly assessments and future client engagements.

Responsibilities:

• Lead the execution of an external penetration test against approved client assets
• Conduct vulnerability identification, validation, and controlled exploitation activities
• Perform web application and public-facing infrastructure assessments
• Validate findings and eliminate false positives
• Develop technical and executive-level reporting
• Participate in client coordination discussions as needed
• Support remediation validation and retesting activities, Required Deliverables:
• Penetration Test Plan
• Asset and Scope Coverage Summary
• Technical Findings Report
• Risk Register & Findings Tracker
• Attack Narrative / Exploitation Path Analysis
• Executive Summary Report
• Prioritized Remediation Plan
• Risk Register Development
• Remediation Validation Report (Retest)

• Defined Risk Register Matrix Important Evaluation Criteria: Our biggest concern is finding a tester who can do more than simply operate security tools. Most penetration testers can:

• Run Nmap
• Run Nessus

• Run Burp Suite Far fewer can:

• Write a professional executive report suitable for leadership review
• Build a clear attack narrative that demonstrates business impact
• Map findings to NIST, CMMC, and compliance requirements
• Present findings and recommendations in a professional manner to technical and non-technical stakeholders Candidates should be prepared to demonstrate both technical expertise and the ability to communicate findings effectively.

• Minimum 8-10 years of professional penetration testing experience
• Demonstrated experience leading enterprise penetration testing engagements
• Strong understanding of NIST SP 800-115, PTES, OWASP, and industry best practices
• Excellent written and verbal communication skills
• Strong organization and project documentation abilities

• Ability to independently manage testing activities and deliverables Preferred Certifications:

• OSCP
• PNPT
• GPEN
• GWAPT
• CISSP
• CEH, * Examples of prior penetration testing reports (sanitized versions acceptable)
• References or examples of previous client engagements
• Proposed fixed-price quote for the engagement
• Estimated timeline for completion
• Brief overview of testing methodology and reporting approach Preference will be given to candidates with prior consulting experience and a demonstrated ability to communicate findings effectively to both technical and executive audiences. All testing tools and associated licenses must be provided by the selected contractor.