Normally when you hire a pen test company, they would install a secure device for you.  You're paying them to do the pen testing, so they should set it up.

Since it's a VM, you would need some sort of software on it that enables them to reach it.  That could be remote desktop over VPN (if you're running a desktop on the machine ie Gnome), it could be OpenSSH, or OpenVPN.  It would be a good idea to communicate with the vendor as to which one they prefer to use.  The pen test box itself needs to be very secure, because you're essentially opening up a hacking toolkit inside your network.  The vendor should be involved in this from start to finish.

Thank you experts

Basically vendor asked to provide us Kali Linux VM for pentest purpose 

VM access will be over SSL VPN ( Global Protect)

Is it secured to give them this VM?

How we can lock down this VM

Can we install anti-malware on Kali linux to verify EDR expected behavior and detection during the testing period?

We use CS Falcon and we do have SOCaaS

Can we inform  SOC team in advance to monitor all pen testing activities. We want to ensure SOC is working well as expected 

Please share your thoughts 

Likely a overkill as the kali tool used will eventually not work with AV unless you have exemption. This defeat purpose for overall efficacy of tester to use the kali. Have rule of engagement as standing order and have trace of activity logged for verifiable evidence for investigation when needed. 

Thank you expert

1- Can we inform  SOC team in advance to monitor all pen testing activities.  We also want to test and validate if the SOC detects malicious behavior correctly during the engagement.

2- I would also like seek your advise as we’ll be giving the tester VPN access and credentials for a Kali Linux jump host. 

What’s your preferred secure method to share those credentials? Username via email, and password different thru different channels like Whatsapp, sms, teams. 

For (1), yes there should be already be SOP. This is legit activities which you will be overseeing to give SOC assurance. You will need to give them the IP to whitelist (or ignore alerts) and time duration (start and end). Once completed, you should inform SOC again.

For (2), VPN login should be 2FA where possible. It can be SMS or email for the short code. Key is to make sure it is the only tester login in so at least there are the userid, email and password registered for the test account. this will help mapped to your log generated in Kali as proxy