Managing Four Concurrent Engagements With One Overloaded Senior Tester
A penetration testing team of six consultants is running four engagements: a 10-day external test for a bank, a 15-day internal test for a hospital, a 5-day cloud configuration review for a SaaS startup, and a 3-day retest for a retail client. The senior tester who is the only one certified to test the bank's core banking API is assigned to all four. Utilization is 96%, and two reports are overdue. The hospital client emails that the last report had inconsistent severity ratings and missed a remediation deadline. A junior tester accidentally ran a credentialed scan against a production subnet without approval, causing a brief CPU spike; there was no outage, but the client noticed. The team uses a shared spreadsheet for scheduling and no peer-review checklist. The practice lead has one week to restore confidence and prevent recurrence, with no budget for new hires this quarter.
1. What immediate actions should the practice lead take to address the hospital complaint and the production scan incident?
Read the worked answer
Hospital complaint: acknowledge within one business day, apologize for the inconsistent report and missed deadline, and ask for the specific findings in dispute. Assign a senior reviewer to re-rate the report against a written severity rubric and issue a corrected version with a change log. Do not argue about the client's perception before reviewing the evidence. Meet the remediation deadline with a named owner and date.
Production scan incident: confirm there was no outage, preserve scan logs and client notification, and inform the client's security contact and the practice lead. Root cause is likely a missing approval gate, not just junior error. Suspend credentialed scanning until a written approval and change ticket exist. Coach the junior tester and review the other consultants' scan permissions. Send the client a short incident note with impact, timeline, and corrective action.
These two incidents are different: one is a quality failure, the other an operational control failure. Both need visible ownership, not a general assurance that the team will do better. The practice lead should also check whether the same approval gap exists on the other three engagements.
2. Propose a sustainable operating model for scheduling, quality, and utilization over the next quarter.
Read the worked answer
Move from a spreadsheet to a simple capacity and skills model. Build a skills matrix showing who can test core banking APIs, Windows and Active Directory, cloud, and social engineering. Stop assigning the single API-certified tester to all four engagements; instead, pair that person with a deputy on the bank test for knowledge transfer and schedule them only where the certification is required. Cap utilization at 80-85% to leave room for quality assurance, incidents, and report writing; 96% is unsustainable and explains the overdue reports.
Introduce a peer-review checklist before any report is released: scope, evidence, severity rubric, compensating controls, remediation, and management response. Use a weekly 30-minute resource review with a named owner for each engagement. For the hospital, add a second reviewer and a 48-hour report QA window. For the junior tester, require approval before any credentialed scan and log all scan targets. These changes are low-cost and directly address the root causes. Hiring can wait, but the single point of failure cannot.
3. Which metrics should the practice lead use to show improvement, and which metrics could create perverse incentives?
Read the worked answer
Use a small dashboard: on-time report delivery, peer-review completion before release, client-reported quality issues, severity-rating consistency from sample audits, remediation retest turnaround, and utilization shown as a target range rather than a single number. Also track near misses and scan-approval exceptions, because they are leading indicators of control failure.
Avoid metrics that reward volume or billability alone: number of findings, number of tests, or 100% utilization will encourage over-testing, rushed reports, and hiding mistakes. Do not rank consultants by findings count; it creates conflicts with clients and discourages collaboration. For the hospital complaint, measure whether the corrected report is accepted and whether the next report passes peer review. For the production incident, measure scan-approval compliance. Review the dashboard monthly and publish it internally with context. The point is to show the practice lead is managing quality and risk, not just selling days.