Senior IT Penetration Tester

at BDO USA, LLP in Oak Brook, Illinois, United States

Job Description

Job Summary:
The Senior Cyber Security Penetration Tester performs offensive security testing for BDO clients and provides practical, risk-based remediation guidance. This role works with client stakeholders to define scope, rules of engagement, and objectives, executes testing to simulate realistic attacker behaviors, and communicates results clearly to both technical and executive audiences. Engagements may include external and internal network penetration testing, Active Directory attack path testing, web and API application testing, cloud and Microsoft 365 security assessments, and AI enabled application testing. The role may also support red team and purple team exercises in collaboration with client SOC teams and contributes to internal tooling and automation through shared repositories.
Job Duties:
Participates in client penetration testing and vulnerability assessment engagements across external and internal networks, Active Directory, web applications, APIs, cloud platforms, and Microsoft 365, including reconnaissance, attack surface discovery, and service enumeration
Uses offensive security tools and techniques to identify, validate, and demonstrate exploitability, including Kali Linux toolchain, Nessus/Tenable, Nmap, Burp Suite, Metasploit, and BloodHound, and validates exploitability end to end for High and Critical findings and when feasible for other findings
Performs authenticated testing when appropriate by coordinating access approvals, applying least privilege, safeguarding secrets, and confirming access removal or rotation at engagement closeout
Performs and reviews web and API security testing using Burp Suite and related techniques, focusing on authentication, session management, access control, injection, insecure deserialization, and business logic, and documents reproducible steps and payloads for remediation and retesting
Reviews AI-enabled applications and LLM integrations for common risks (for example, prompt injection, sensitive data exposure, insecure output handling, and tool or function calling abuse) and provides practical mitigation guidance aligned to OWASP Top 10 for LLM Applications
Supports scoping and delivery under the direction of an assigned Project Manager by documenting objectives and rules of engagement, coordinating technical logistics with client teams, providing timely status updates across concurrent engagements, and ensuring testing is performed safely within approved scope
For internal and Active Directory engagements, maps and demonstrates feasible attack paths, for example, using BloodHound or equivalent, including privilege escalation and lateral movement, validates root causes in configuration and permissions, and provides actionable remediation
Documents reproducible workpapers and evidence with appropriate data protection practices, participates in peer review and quality assurance, and escalates critical findings quickly to support timely mitigation
Produces high-quality client deliverables, including test plans, technical reports, and executive readouts, with clear evidence, proof-of-exploit artifacts, risk ratings, reproduction steps, and prioritized remediation recommendations, and facilitates results discussions and remediation workshops
Facilitates red team style engagements in collaboration with client SOC teams by coordinating deconfliction, leveraging SIEM telemetry to validate detection and response, and supporting threat hunting and purple team activities tied to observed attacker behaviors
Performs validation and retesting to confirm remediation effectiveness and documents retest results for client stakeholders
Maintains internal offensive security tooling, scripts, and reusable testing components, including automation and agent-based utilities, to improve assessment repeatability and quality. Contributes through Git workflows, pull requests, and code review
Other duties as required
Supervisory Responsibilities:
N/A
Qualifications, Knowledge, Skills, and Abilities:
Education:
High school diploma or GED, required
Bachelor's degree in Cybersecurity, Information Security, or Computer Science, preferred
Experience:
Four (4) or more years of hands-on penetration testing and security assessment experience (network, web, API, wireless, cloud, and/or Microsoft 365), including scoping, execution, reporting, and client presentations, required
Demonstrated experience producing professional services deliverables (test plans, technical reports, executive summaries) and communicating complex technical issues to non-technical stakeholders, required
Exposure to testing AI-enabled applications (including LLM-based features) and familiarity with emerging guidance such as OWASP Top 10 for LLM Applications, preferred
Experience supporting social engineering assessments, such as phishing, vishing, baiting, and tailgating, preferred
Strong fundamentals in Windows and Linux administration, TCP/IP networking, and DNS, required
Hands-on experience administering and troubleshooting Active Directory in enterprise environments, including users and groups, group policy, permissions, and DNS integration, plus foundational knowledge of authentication protocols and identity flows such as Kerberos, NTLM, SAML, OAuth 2.0, and OpenID Connect, required
Two (2) or more years of experience supporting IT Penetration and Security projects such as PTES, OWASP, SANS, or other cyber security frameworks, preferred
Experience working with SIEM platforms and core SOC workflows, including basic threat hunting and alert triage to validate detections during red team or purple team activities, preferred
Hands-on experience with scripting/automation and light tool development to improve testing efficiency and repeatability (e.g., Python, PowerShell, Bash), required
DevOps and engineering fundamentals, including Git version control, pull request workflows, and exposure to CI/CD and containers (for example, GitHub Actions, Azure DevOps pipelines, Docker), preferred
Experience conducting internal network and Active Directory penetration tests, including attack path mapping (for example, using BloodHound or equivalent), privilege escalation, lateral movement, and prioritized remediation guidance, preferred
Experience working within a national consulting organization or professional services, preferred
License(s)/Certification(s):
OSCP (or equivalent hands-on penetration testing certification), strongly preferred; additional certifications such as OSCE, OSWE/OSWA, GIAC (GPEN, GXPN), CRTO (or equivalent), CEH, LPT, CompTIA PenTest+, CISSP, or other relevant certifications, preferred
AWS Cloud Practitioner or Microsoft 365 Certified: Security Administrator Associate, preferred
Software:
Proficient with offensive security and assessment toolsets (e.g., Kali Linux toolchain, Burp Suite, Metasploit, Nmap, Nessus/Tenable, and common AD assessment tooling such as BloodHound), including scan configuration/tuning, manual verification, and evidence collection, required
Proficient with Git-based source control and collaboration platforms (for example, GitHub), including branching, pull requests, and peer review, required
Proficient in the use of Windows and Microsoft Office Suite, specifically Word, Excel, and PowerPoint, required
Familiarity with SIEM tooling and log investigation workflows (for example, Splunk and Microsoft Sentinel) to support validation of detection and response during engagements, preferred
Experience using AI-assisted development tools (for example, GitHub Copilot and Claude Code) to accelerate scripting and tool development, with the ability to use these tools responsibly without exposing client confidential data or sensitive credentials, preferred
Experience with cloud platforms and identity/security services (e.g., Microsoft Azure and Microsoft 365) and the ability to script/automate tasks (e.g., Python, PowerShell, Bash), preferred
Familiarity with AI/LLM security testing approaches and tooling (e.g., structured prompt testing, abuse-case libraries, and API-driven test harnesses) and the ability to use AI-assisted tooling responsibly without exposing client confidential data, preferred
Language(s):
Multilingual capabilities (read, speak and/or write), preferred
Other Knowledge, Skills, & Abilities:
Ability to maintain a high level of confidentiality and professionalism
Ability to communicate with professionals at all organizational levels
Ability to build and maintain strong relationships with BDO and client personnel
Solid organizational and excellent verbal and written communication skills
Ability to successfully multi-task while working independently or within a group environment
Ability to translate technical vulnerabilities into clear risk statements and actionable remediation guidance, including prioritization and validation steps

Keyword: Cyber, Security, Penetration Tester, Black Box Testing, Certified Ethical Hacker, Microsoft 365 Azure Cloud, AWS Cloud, GIAC, GPEN, GXPN, Licensed Penetration Tester Master, LPT, Security Administrator, IT Network Security Assessments, Wired, Wireless

Individual salaries that are offered to a candidate are determined after consideration of numerous factors including but not limited to the candidate's qualifications, experience, skills, and geography.
National Range: $120,000 - $160,000
Maryland Range: $120,000 - $160,000
NYC/Long Island/Westchester Range: $120,000 - $160,000

All qualified applicants will receive consideration for employment without regard to race, age, color, religion, sex, national origin, disability, protected veteran status, or any other classification protected by law.