Cybersecurity Senior Penetration Tester

1624 Roche Diagnostics S.L.; Sant Cugat del Vallès; Presencial; EUR 90.000 - 130.000; Jornada completa

Descripción de la vacante

Roche is seeking a Senior Penetration Tester to join our Product Security & Privacy Organization (PSPO). In this hands-on role, you will lead vulnerability assessments and penetration testing across Roche’s digital solutions, cloud applications, and medical devices, collaborating with engineering and architecture teams to strengthen cyber defenses and ensure patient safety.

You will mentor junior pentesters and contribute to a central repository of testing methods, while continuously optimizing

Formación

• 5+ years of experience in offensive security, including strategic planning and hands-on execution across cloud, web, APIs, and devices.
• Bachelor's degree in Computer Science, Information Systems, or related field preferred.
• Solid background in vulnerability assessment and penetration testing.
• Solid knowledge of OWASP Top 10 and SDLC methodologies.
• Experience automating security controls (e.g., shell scripting, Python).
• Strong communication to explain vulnerabilities to technical and non-technical stakeholders.
• Industry certifications such as SANS GIAC, OSCP, CISSP, CISA, CISM or ISO27001 Lead Auditor are valued.
• Knowledge of AI/ML security risks and offensive agentic AI is highly valued.

Responsabilidades

• Design, prioritise, and lead internal penetration testing across the product portfolio (digital, cloud, medical devices).
• Identify and assess vulnerabilities; help product teams prioritise and fix them throughout the lifecycle.
• Provide strategic technical support and security knowledge during design and development to ensure security by design.
• Mentor and coach junior and mid-level pentesters in advanced testing techniques.
• Contribute to central testing methods and tools repository for reuse across the business.
• Support Incident Response with technical analysis and forensics.
• Execute red team exercises to assess resilience of products and solutions.
• Prepare and present security reports with risk assessments and actionable recommendations.
• Promote defence and security-by-design across product lines.
• Continuously optimise processes, playbooks, and tools for scalable product security.
• Explore and integrate AI-enabled offensive testing capabilities to simulate sophisticated threats.

Conocimientos

Offensive security

Strategic planning

Hands-on execution

Leadership

Educación

Bachelor's degree in CS/IS or related field

Herramientas

Shell scripting

Python

Vulnerability assessment tools

Descripción del empleo

Who We Are

At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.

We are passionate about transforming patients’ lives through innovation. We act boldly — because we believe that good business means a better world. Every day, we commit to scientific rigor, unshakable ethics, and broad access to medical breakthroughs. Together, we’re building a better tomorrow, today. We’re also deeply committed to diversity, equity, and inclusion. By bringing together people with a wide range of backgrounds, perspectives, and skills, we create an environment where innovation thrives, creativity flourishes, and everyone belongs.

The Opportunity

We’re looking for a Senior Penetration Tester to join our Product Security & Privacy Organization (PSPO) — a dynamic global team ensuring the resilience and trustworthiness of Roche’s products and digital solutions. In this hands‑on role, you’ll lead vulnerability assessments and penetration testing activities across our physical and cloud‑based products. You’ll collaborate with engineering, product, and architecture teams to strengthen Roche’s cyber defenses and ensure that innovation in diagnostics goes hand in hand with security and patient safety. Your work will directly influence the security of next‑generation healthcare technologies used worldwide.

What You’ll Do

• Design, prioritise, and lead internal penetration testing activities across our diverse product portfolio, including digital solutions, cloud applications and medical devices.
• Proactively identify and assess vulnerabilities, and collaborate with product teams to prioritise and fix them throughout the product lifecycle.
• Provide strategic technical support and security knowledge to product teams during the design and development phases to ensure security by design.
• Mentor and coach junior and mid‑level pentesters in advanced testing techniques and strategic thinking.
• Collaborate with the team to contribute to, utilise, and help maintain the central repository of testing methods and tools, supporting our goal of reusability across the business.
• Support the Incident Response team with technical analysis and forensics during security incidents.
• Execute red team exercises to assess product and solution resilience.
• Prepare and present clear security reports with risk assessments and actionable recommendations.
• Contribute to integrating defence and security‑by‑design principles across product lines.
• Continuously optimise processes, playbooks and tools for scalable product security.
• Explore and integrate advanced automation and offensive agentic AI capabilities into the penetration testing lifecycle to simulate sophisticated, autonomous threat actor behaviours.

Who You Are

You are a technically strong, curious, and impact‑driven professional who thrives in complex, fast‑moving environments. You enjoy uncovering vulnerabilities and turning insights into stronger, safer products. You share Roche’s core values: Customer Empathy, Trust, Ownership, Bias for Action, Curiosity, Optimism, Collaboration, and Data‑driven Decision‑Making. Grade: SE6‑SE7.

Your profile includes:

• Proven senior‑level experience (5+ years) in offensive security, encompassing strategic planning and hands‑on execution across diverse environments (cloud, web, APIs, and specialised devices).
• Bachelor’s degree in Computer Science, Information Systems, or a related field preferred.
• Solid background in vulnerability assessment and penetration testing.
• Solid knowledge of common attack vectors, security best practices (e.g., OWASP Top 10), and Secure Development Lifecycle (SDLC) methodologies.
• Experience automating security controls (e.g., shell scripting, Python).
• In‑depth understanding of information security and privacy risks.
• Experience with incident response and forensics (a plus).
• Strong ability to communicate complex vulnerabilities, their impact, and required mitigation steps clearly to technical and non‑technical stakeholders, acting as a trusted advisor to influence business and architectural decisions.
• Strong problem‑solving, communication, teamwork, and leadership skills.
• Proactive, collaborative, and self‑driven, focused on continuous learning and sharing knowledge within a diverse global team.
• Proactive, self‑driven, hands‑on, and solution‑oriented mindset.
• Relevant industry certifications such as SANS GIAC (GCIH, GPEN, GXPEN, GCIA, GCFA, GSE), OSCP, OSEP, OSCE, OSWE, CISSP, CISA, CISM, or ISO27001 Lead Auditor are highly valued.
• Strong understanding of AI/ML security risks (e.g., OWASP Top 10 for LLMs) and hands‑on experience or deep knowledge in leveraging offensive agentic AI to automate complex attack chains.

Why Join Us?

This is more than a job — it’s an opportunity to shape the future of healthcare technology, strengthen the security of life‑saving solutions, and directly protect patient trust. At Roche, your expertise matters every day. You’ll collaborate with world‑class teams, tackle meaningful challenges, and grow in a global environment that values learning, integrity, and innovation. Together, we make technology safe for better health — everywhere.

Ready to Secure What’s Next? Join us and help redefine how security powers trust in healthcare.

Who we are

A healthier future drives us to innovate. Together, more than 100,000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life‑changing healthcare solutions that make a global impact. Let’s build a healthier future, together.

Roche is an Equal Opportunity Employer. We believe it’s urgent to deliver medical solutions right now – even as we develop innovations for the future. We are passionate about transforming patients’ lives. We are courageous in both decision and action. And we believe that good business means a better world. That is why we come to work each day. We commit ourselves to scientific rigor, unassailable ethics, and access to medical innovations for all. We do this today to build a better tomorrow. We are proud of who we are, what we do, and how we do it. We are many, working as one across functions, across companies, and across the world. We are Roche.