PCI penetration tester

- Execute annual PCI penetration testing in compliance with PCI DSS requirements and associated guidance. - Conduct external penetration tests on authorized public-facing assets, including internet-accessible IP ranges and systems. - Perform internal penetration testing within Cardholder Data Environments and related infrastructures. - Carry out PCI segmentation testing to verify isolation between non-CDE and CDE network segments. - Assist in the development of the testing scope, methodology, communication plan, and reporting format. - Engage in non-invasive reconnaissance by reviewing public records and DNS information. - Identify, validate, and safely exploit vulnerabilities to demonstrate potential impacts without disruptive testing. - Avoid destructive or denial-of-service testing without explicit authorization. - Notify stakeholders about vulnerabilities affecting business processes or sensitive data immediately. - Organize troubleshooting sessions with client network and security teams during tests. - Be ready to support after-hours testing when necessary. - Verify remediation by retesting previously identified vulnerabilities and access paths. - Produce clear and actionable penetration testing reports detailing findings and remediation guidance. - Participate in weekly status meetings to update on testing progress and milestones. - Ensure secure handling of sensitive data encountered during tests, following appropriate protocols for data destruction. - Operate independently from PCI QSA assessment activities while coordinating with QSA teams as necessary.