When in the project life-cycle would you fit in external penetration/security testing of the software?
It happens at every step in the life cycle.
First, penetration testing is only one small piece of a more complex security puzzle.
Second, penetration testing includes a run-time configuration and proper administration as well as a software implementation issue. Penetration testing requires proper patching and configuration of OS, web server, database, firewalls and application software.
You do penetration testing of the architecture before you start doing detailed designs. Is the architecture itself secure?
You do penetration testing of the design. How secure is the design? What penetration opportunities will be present?
You do penetration testing as part of coding and unit testing. Does the code meet the design? Does it properly use architectural features to prevent security problems?
You can then subject the final software product to all kinds of security scrutiny including -- but not limited to -- penetration testing.
Security is pervasive. Or it has holes. It's not a "step" in the work plan. It's an underlying principle.