Senior Cybersecurity Penetration Tester

BDO USA, LLP; Oak Brook (IL); On-site; USD 120,000 - 160,000; Full time

Job summary

BDO USA, LLP is seeking a Senior Cyber Security Penetration Tester to perform offensive security testing for clients, define scope and rules of engagement, and communicate results to technical and executive audiences. The role includes external/internal network testing, AD attack paths, and cloud/M365 security assessments, with potential red/purple team collaboration.

Responsibilities include risk-based remediation guidance, documentation of reproducible steps, and contributing to internal

Qualifications

• Four (4) or more years of hands-on penetration testing and security assessment experience across networks, web, API, cloud, and Microsoft 365.
• Experience producing professional services deliverables (test plans, technical reports, executive summaries) and communicating complex issues to non-technical stakeholders.
• Exposure to testing AI-enabled applications and familiarity with OWASP Top 10 for LLM Applications is preferred.

Responsibilities

• Participates in client penetration testing and vulnerability assessments across external and internal networks, AD, web apps, APIs, cloud platforms, and Microsoft 365.
• Uses offensive security tools to identify, validate, and demonstrate exploitability and validates findings end-to-end.
• Produces high-quality client deliverables including test plans, technical reports, and executive readouts; documents steps and remediation recommendations.

Skills

Penetration testing

Security assessment

Windows administration

Linux administration

Scripting (Python/PowerShell)

Stakeholder communication

Education

Bachelor’s degree in Cybersecurity/Information Security/CS

High school diploma or GED

Tools

Kali Linux toolchain

Burp Suite

Nessus/Tenable

Nmap

Metasploit

BloodHound

Job description

BDO USA, LLP is seeking a Senior Cyber Security Penetration Tester to perform offensive security testing for clients, define scope and rules of engagement, and communicate results to technical and executive audiences. The role includes external/internal network testing, AD attack paths, and cloud/M365 security assessments, with potential red/purple team collaboration.

Responsibilities include risk-based remediation guidance, documentation of reproducible steps, and contributing to internal