Invadel is a New York City penetration testing firm. Every engagement is fixed-scope and fixed-price, agreed in writing, with public prices at invadel.com/pricing and a free retest. This is a contract role, remote within the United States, paid per engagement; work is typically one to three days per client engagement, attached to a penetration test, plus occasional readiness reviews.
What you will do: produce the framework mapping section of each report and the attestation letter clients hand to auditors and customers; review client scope against the requirement that drives the test (for example PCI DSS 11.4 segmentation testing or NYDFS 500.5) and flag gaps before testing starts; answer auditor and customer security questionnaire follow-ups with the client; run readiness reviews for clients preparing for a first SOC 2 Type II or PCI DSS assessment; keep the compliance mapping templates current.
What we need: four or more years in security compliance, audit or GRC with direct experience of SOC 2 and at least one of PCI DSS, HIPAA, ISO 27001, NYDFS 500 or CMMC; enough technical grounding to read a penetration test finding and explain what it means for a control; clear writing for auditors, executives and engineers; based in the United States with authorization to work here; two professional references.
Nice to have: time on the assessor side (QSA, SOC 2 audit team, C3PAO) or inside a compliance automation platform; experience with New York financial services or healthcare clients.
Full description, pay range and application:
Invadel is a New York City-based penetration testing firm that provides fixed-scope, fixed-price security testing engagements with public pricing and complimentary retests. The company specializes in manual web application, API, and cloud infrastructure penetration testing, as well as source code security reviews across multiple programming languages. Invadel conducts comprehensive security assessments including authorization testing, vulnerability validation, privilege escalation attempts, and compliance mapping against standards like CIS Foundations, SOC 2, PCI DSS, and HIPAA. Each engagement delivers detailed reports with CVSS-scored findings, prioritized remediation recommendations, and verification of fixes through retesting.
