PCI DSS Pentesting Compliance Audit

I must obtain PCI DSS certification and need a full penetration-testing engagement that satisfies Requirement 11.3. This covers both external/internal network assets and customer-facing or internal web/mobile applications. Scope • Map the card-holder data environment, then execute comprehensive network and application tests (black-box and authenticated where applicable). • Exploit, not just scan, to prove impact while maintaining evidence for auditors. • Re-test once fixes are applied to confirm closure. Deliverables • Formal methodology and test plan aligned with PCI DSS 4.x. • Detailed vulnerability report with risk ratings and reproducible PoCs. • Executive summary for management and a technical appendix for engineers. • Remediation recommendations prioritised by risk. • Attestation of penetration test completion suitable for submission to my QSA. I will grant VPN or on-site access, plus staging credentials for application testing. All testing must respect our change-control windows and be performed with Burp Suite, Nmap, Metasploit, or equivalent industry-standard tools. Data collected must remain confidential and deleted after sign-off. Please indicate your testing framework, sample redacted reports, and estimated duration for initial test and follow-up verification.