I'm late to the party, but I just couldn't help throw a few more thoughts into here.



For this function, I'd suggest checking out Dradis.  http://dradis.nomejortu.com/

It's a work in progress, but at Foreground we've already started testing it and we're thinking about putting it in production.



Since traditional pen-tests aren't highly complex projects, you don't need a full-scale PM.  Here's where a student intern can really help out - I'm a big fan of finding someone in a local college who is looking to become a project manager... they can learn to PM, track data, track progress, etc.  And you get a resource appropriate for the level required. 

Depends on the project, of course.