Lead Penetration Tester

Comtech LLC is seeking a highly skilled Lead Penetration Tester to spearhead the execution of the PSD Database Penetration Testing Project under the State of Vermont s Agency of Digital Services (ADS). The Lead Penetration Tester will be responsible for planning, conducting, and documenting comprehensive penetration tests across critical systems, applications, and databases, ensuring vulnerabilities are identified, validated, and communicated with actionable remediation strategies.

This position requires deep expertise in both black-box and authenticated penetration testing, with advanced proficiency in exploiting vulnerabilities in web applications, REST APIs, operating systems, and databases. The Lead Tester will collaborate closely with cybersecurity engineers, analysts, and the Project Manager to meet all testing milestones defined within the project SOW.

The Lead Penetration Tester will be responsible for tasks including but not limited to:

• Lead the end-to-end penetration testing effort for the PSD database environment and associated systems per the project SOW.
• Develop detailed penetration test plans, methodologies, and rules of engagement (ROE) aligned with NIST SP 800-115, OWASP, and CIS standards.
• Conduct external, internal, and web application penetration tests, including black-box, gray-box, and authenticated assessments.
• Perform detailed testing on REST APIs, authentication mechanisms, and session management controls.
• Execute network, database, and operating system exploitation to demonstrate the practical impact of identified vulnerabilities.
• Utilize both commercial and open-source tools (Burp Suite, Metasploit, Nmap, Nessus, SQLmap, Hydra, Cobalt Strike, etc.) to perform in-depth analysis.
• Develop and maintain custom scripts and exploits to verify vulnerability exploitation and validate remediation effectiveness.
• Generate and present technical and executive-level reports, detailing vulnerabilities, exploitation methods, risk ratings, and recommended mitigations.
• Work with client stakeholders to remediate and validate fixes through post-mitigation retesting.
• Ensure all testing and data handling activities are compliant with ADS cybersecurity policies, data privacy standards, and federal/state security requirements.
• Participate in status meetings, risk reviews, and deliverable walkthroughs with ADS/PSD stakeholders and Comtech s internal project management team.
• Support creation of the final Penetration Testing Report, Remediation Validation Report, and Destruction Attestation Report per SOW.