Senior IT Penetration Tester

## Senior Cyber Security Penetration Tester As a Senior Cyber Security Penetration Tester at BDO, you’ll perform offensive security testing for our clients, delivering practical, risk-based remediation guidance that helps them stay ahead of real-world threats. This isn’t a checkbox exercise — you’ll work directly with client stakeholders to define scope, rules of engagement, and objectives, then execute testing that simulates realistic attacker behaviors. You’ll need to communicate findings clearly to both technical teams and executive audiences, bridging the gap between vulnerability details and business risk. You’ll dive into a variety of engagements: external and internal network penetration tests, Active Directory attack path assessments, web and API application testing, cloud and Microsoft 365 security reviews, and even AI-enabled application testing. Depending on your client’s needs, you may also support red team and purple team exercises in collaboration with their SOC teams. And you’ll contribute to our internal tooling and automation through shared repositories — always looking for ways to improve assessment repeatability and quality. ### What You’ll Do Day-to-Day You’ll participate in penetration testing and vulnerability assessments across networks, Active Directory, web apps, APIs, cloud platforms (including AWS and Azure), and Microsoft 365. That means reconnaissance, attack surface discovery, service enumeration, and using tools like the Kali Linux toolchain, Nessus/Tenable, Nmap, Burp Suite, Metasploit, and BloodHound to identify, validate, and demonstrate exploitability. For High and Critical findings — and when feasible for others — you’ll validate end-to-end exploitability. When authenticated testing is needed, you’ll coordinate access approvals, apply least privilege, safeguard secrets, and confirm access is removed or rotated at engagement closeout. You’ll perform thorough web and API security testing with Burp Suite, focusing on authentication, session management, access control, injection flaws, insecure deserialization, and business logic issues. You’ll document reproducible steps and payloads to support remediation and retesting. For AI-enabled applications and LLM integrations, you’ll assess common risks like prompt injection, sensitive data exposure, insecure output handling, and tool/function calling abuse, providing mitigation guidance aligned with OWASP Top 10 for LLM Applications. You’ll support scoping and delivery alongside a Project Manager, documenting objectives and rules of engagement, coordinating technical logistics with client teams, and providing timely status updates across concurrent engagements. Safety is key — you’ll ensure all testing stays within approved scope. For internal and Active Directory engagements, you’ll map feasible attack paths (for example, using BloodHound or equivalents), demonstrate privilege escalation and lateral movement, validate root causes in configuration and permissions, and deliver actionable remediation steps. Documentation is a big part of the role: you’ll produce reproducible workpapers and evidence with proper data protection, participate in peer review and quality assurance, and escalate critical findings quickly for timely mitigation. You’ll also create high-quality client deliverables — test plans, technical reports, executive readouts — with clear evidence, proof-of-exploit artifacts, risk ratings, reproduction steps, and prioritized recommendations. You’ll facilitate results discussions and remediation workshops to help clients understand and fix issues. Red team style engagements? You’ll coordinate deconfliction, leverage SIEM telemetry to validate detection and response, and support threat hunting and purple team activities tied to observed attacker behaviors. You’ll also perform validation and retesting to confirm remediation effectiveness, documenting retest results for client stakeholders. Beyond client work, you’ll maintain offensive security tooling, scripts, and reusable components — including automation and agent-based utilities — contributing through Git workflows, pull requests, and code review. ### What We’re Looking For You need at least four years of hands-on penetration testing and security assessment experience (network, web, API, wireless, cloud, and/or Microsoft 365), including scoping, execution, reporting, and client presentations. That experience must include producing professional services deliverables like test plans, technical reports, and executive summaries, and communicating complex technical issues to non-technical stakeholders. A high school diploma or GED is required; a bachelor’s degree in Cybersecurity, Information Security, or Computer Science is preferred. Strong fundamentals in Windows and Linux administration, TCP/IP networking, and DNS are required. You should also have hands-on experience administering and troubleshooting Active Directory in enterprise environments — users and groups, group policy, permissions, DNS integration — plus foundational knowledge of authentication protocols like Kerberos, NTLM, SAML, OAuth 2.0, and OpenID Connect. Scripting and automation experience with Python, PowerShell, or Bash is required to improve testing efficiency and repeatability. We strongly prefer candidates with an OSCP or equivalent hands-on penetration testing certification. Additional certifications like OSCE, OSWE/OSWA, GIAC (GPEN, GXPN), CRTO, CEH, LPT, CompTIA PenTest+, or CISSP are a plus. AWS Cloud Practitioner or Microsoft 365 Certified: Security Administrator Associate are also preferred. Experience testing AI-enabled applications (including LLM-based features) and familiarity with OWASP Top 10 for LLM Applications is preferred. Experience with social engineering assessments (phishing, vishing, baiting, tailgating), SIEM platforms and SOC workflows (Splunk, Microsoft Sentinel), DevOps and CI/CD pipelines (GitHub Actions, Azure DevOps, Docker), and internal network/AD penetration tests with attack path mapping is also preferred. Experience working within a national consulting organization or professional services is a bonus. You should be proficient with offensive security tools (Kali Linux, Burp Suite, Metasploit, Nmap, Nessus/Tenable, BloodHound), Git-based source control (GitHub), and Microsoft Office Suite (Word, Excel, PowerPoint). Familiarity with AI-assisted development tools (GitHub Copilot, Claude Code) is preferred, as long as you can use them responsibly without exposing client confidential data. ### Compensation & Benefits Individual salaries are determined based on qualifications, experience, skills, and geography. The national salary range for this role is $120,000 to $160,000. In Maryland and the NYC/Long Island/Westchester area, the range is also $120,000 to $160,000. At BDO, we offer a comprehensive Total Rewards package, including an Employee Stock Ownership Plan (ESOP) that gives you a stake in the firm’s success. Benefits may be subject to eligibility requirements. BDO is an equal opportunity employer, including disability and veterans.