Penetration Tester
When to Use
- Plan or execute authorized penetration tests (cloud workload, wireless) spanning multiple domains under one ROE
- Coordinate dedicated network/AD/infra assessments →
network-pentester
- Draft or validate rules of engagement, asset lists, and emergency stop procedures
- Perform reconnaissance and vulnerability identification with manual validation
- Develop proof-of-concept exploitation and document attack paths within agreed impact
- Execute in-scope post-exploitation (credential proof, lateral movement, objective demo) with cleanup
- Produce remediation-focused reports and retest critical/high findings
When NOT to Use
- Deep web application or API-only assessments (OWASP, proxy methodology, GraphQL) →
web-pentester
- Dedicated internal/external network, AD, segmentation, wireless methodology →
network-pentester
- Triage SIEM/EDR alerts or run SOC playbooks →
soc-analyst
- Lead live incident command, war room, or stakeholder comms →
incident-responder
- Acquire and analyze forensic disk/memory images →
digital-forensics-analyst
- Disassembly, decompilation, patch diff, or malware RE lab work →
reverse-engineer
- Jailbreak LLMs, prompt injection, or agent tool abuse →
ai-redteam
- Campaign planning, purple team, detection validation at program level →
red-team-specialist
- Implement cloud IAM, CSPM, landing zone guardrails →
cloud-security-engineer
- Map audit controls or continuous compliance evidence →
compliance-engineer
- Add CI/CD security gates or SBOM pipelines →
devsecops
Related skills
| Need |
Skill |
| Web/API-focused OWASP and proxy-based testing |
web-pentester |
| Network, AD, lateral movement, segmentation, wireless |
network-pentester |
| Security program, pentest program governance, GRC |
cybersecurity |
| Implement fixes for findings (IAM, WAF, SIEM) |
information-security-engineer |
| Threat context for findings; IOC/TTP intel (not pentest execution) |
cti-analyst |
| Cloud control implementation and misconfig remediation |
cloud-security-engineer |
| LLM/agent adversarial testing |
ai-redteam |
| Red team campaigns, purple team, ATT&CK emulation |
red-team-specialist |
| SOC alert triage and playbooks |
soc-analyst |
| Proactive threat hunts from pentest hypotheses |
threat-hunter |
| Live IR command and containment cadence |
incident-responder |
| Post-incident forensic artifacts |
digital-forensics-analyst |
| Binary/protocol RE and patch analysis |
reverse-engineer |
| Audit evidence and control mapping |
compliance-engineer |
| Pipeline/supply-chain testing in CI |
devsecops |
| Offensive reporting for customers |
tech-writer-researcher |
Core Workflows
1. Scope and authorization
Do not test without written authorization.
- Confirm signed SOW/ROE: assets, methods, windows, contacts
- Define out-of-scope (third parties, prod PII, physical access, DoS unless approved)
- Agree severity rubric and evidence handling
- Establish emergency stop and escalation path
- Prefer isolated lab or designated test tenants
See references/scoping_rules_of_engagement.md and references/penetration_tester_scope.md.
2. Reconnaissance and vulnerability identification
passive OSINT → asset inventory → service/version ID → auth surface mapping → validate findings
Document source, timestamp, tool, and raw output references. Validate scanner output manually.
See references/recon_and_vulnerability_identification.md.
3. Exploitation and post-exploitation (in scope only)
- Minimal PoC steps; redacted evidence
- Clear preconditions (role, network position, config)
- Stop at agreed impact; chain into attack paths when useful
- Post-exploitation only per ROE; remove persistence and test artifacts before closeout
See references/exploitation_and_post_exploitation.md.
4. Reporting, remediation, and retest
Per finding: title, severity, impact, reproduction, evidence, remediation, retest criteria. Deliver executive summary + technical appendix; schedule retest for critical/high.
See references/reporting_and_remediation.md and references/retest_and_safe_practices.md.
When to load references
| Topic |
Reference |
| Role boundaries |
references/penetration_tester_scope.md |
| Authorization and ROE |
references/scoping_rules_of_engagement.md |
| Recon and vuln ID |
references/recon_and_vulnerability_identification.md |
| Exploitation and post-ex |
references/exploitation_and_post_exploitation.md |
| Reports and remediation |
references/reporting_and_remediation.md |
| Retest and safe practices |
references/retest_and_safe_practices.md |
1---2name: penetration-tester3description: Guides authorized penetration testing—scoping and rules of engagement, reconnaissance, vulnerability identification, exploitation within scope, post-exploitation documentation, evidence and remediation reporting, and retest validation. Emphasizes written authorization, RoE boundaries, and safe/legal testing. Use for pentest, penetration test, ethical hacking, authorized assessment—not enterprise adversary simulation or purple-team campaigns (red-team-specialist), dedicated network/AD/infra pentest (network-pentester), deep web/API-only assessments (web-pentester), SOC alert triage (soc-analyst), incident command (incident-responder), forensic imaging (digital-forensics-analyst), binary/firmware RE (reverse-engineer), LLM/adversarial AI testing (ai-redteam), or implementing cloud guardrails (cloud-security-engineer).4---56# Penetration Tester78## When to Use910- Plan or execute **authorized** penetration tests (cloud workload, wireless) spanning multiple domains under one ROE11- Coordinate dedicated **network/AD/infra** assessments → `network-pentester`12- Draft or validate **rules of engagement**, asset lists, and emergency stop procedures13- Perform **reconnaissance** and **vulnerability identification** with manual validation14- Develop **proof-of-concept exploitation** and document **attack paths** within agreed impact15- Execute **in-scope post-exploitation** (credential proof, lateral movement, objective demo) with cleanup16- Produce **remediation-focused reports** and **retest** critical/high findings1718## When NOT to Use1920- Deep **web application or API-only** assessments (OWASP, proxy methodology, GraphQL) → `web-pentester`21- Dedicated **internal/external network, AD, segmentation, wireless** methodology → `network-pentester`22- Triage SIEM/EDR alerts or run SOC playbooks → `soc-analyst`23- Lead live incident command, war room, or stakeholder comms → `incident-responder`24- Acquire and analyze forensic disk/memory images → `digital-forensics-analyst`25- Disassembly, decompilation, patch diff, or malware RE lab work → `reverse-engineer`26- Jailbreak LLMs, prompt injection, or agent tool abuse → `ai-redteam`27- Campaign planning, purple team, detection validation at program level → `red-team-specialist`28- Implement cloud IAM, CSPM, landing zone guardrails → `cloud-security-engineer`29- Map audit controls or continuous compliance evidence → `compliance-engineer`30- Add CI/CD security gates or SBOM pipelines → `devsecops`3132## Related skills3334| Need | Skill |35|---|---|36| Web/API-focused OWASP and proxy-based testing | `web-pentester` |37| Network, AD, lateral movement, segmentation, wireless | `network-pentester` |38| Security program, pentest program governance, GRC | `cybersecurity` |39| Implement fixes for findings (IAM, WAF, SIEM) | `information-security-engineer` |40| Threat context for findings; IOC/TTP intel (not pentest execution) | `cti-analyst` |41| Cloud control implementation and misconfig remediation | `cloud-security-engineer` |42| LLM/agent adversarial testing | `ai-redteam` |43| Red team campaigns, purple team, ATT&CK emulation | `red-team-specialist` |44| SOC alert triage and playbooks | `soc-analyst` |45| Proactive threat hunts from pentest hypotheses | `threat-hunter` |46| Live IR command and containment cadence | `incident-responder` |47| Post-incident forensic artifacts | `digital-forensics-analyst` |48| Binary/protocol RE and patch analysis | `reverse-engineer` |49| Audit evidence and control mapping | `compliance-engineer` |50| Pipeline/supply-chain testing in CI | `devsecops` |51| Offensive reporting for customers | `tech-writer-researcher` |5253## Core Workflows5455### 1. Scope and authorization5657**Do not test without written authorization.**58591. Confirm signed SOW/ROE: assets, methods, windows, contacts602. Define out-of-scope (third parties, prod PII, physical access, DoS unless approved)613. Agree severity rubric and evidence handling624. Establish emergency stop and escalation path635. Prefer isolated lab or designated test tenants6465**See `references/scoping_rules_of_engagement.md` and `references/penetration_tester_scope.md`.**6667### 2. Reconnaissance and vulnerability identification6869```70passive OSINT → asset inventory → service/version ID → auth surface mapping → validate findings71```7273Document source, timestamp, tool, and raw output references. **Validate** scanner output manually.7475**See `references/recon_and_vulnerability_identification.md`.**7677### 3. Exploitation and post-exploitation (in scope only)7879- Minimal PoC steps; redacted evidence80- Clear preconditions (role, network position, config)81- Stop at agreed impact; chain into attack paths when useful82- Post-exploitation only per ROE; **remove** persistence and test artifacts before closeout8384**See `references/exploitation_and_post_exploitation.md`.**8586### 4. Reporting, remediation, and retest8788Per finding: title, severity, impact, reproduction, evidence, remediation, retest criteria. Deliver executive summary + technical appendix; schedule retest for critical/high.8990**See `references/reporting_and_remediation.md` and `references/retest_and_safe_practices.md`.**9192## When to load references9394| Topic | Reference |95|---|---|96| Role boundaries | `references/penetration_tester_scope.md` |97| Authorization and ROE | `references/scoping_rules_of_engagement.md` |98| Recon and vuln ID | `references/recon_and_vulnerability_identification.md` |99| Exploitation and post-ex | `references/exploitation_and_post_exploitation.md` |100| Reports and remediation | `references/reporting_and_remediation.md` |101| Retest and safe practices | `references/retest_and_safe_practices.md` |
daemon-blockint-tech