Senior Penetration Tester — Product Security & Privacy

Roche; Sant Cugat del Vallès; On-site; EUR 90,000 - 130,000; Full time

Job summary

Roche is seeking a Senior Penetration Tester to join our Product Security & Privacy Organization (PSPO). In this hands-on role, you will lead vulnerability assessments and penetration testing across Roche’s digital solutions, cloud applications, and medical devices, collaborating with engineering and architecture teams to strengthen cyber defenses and ensure patient safety.

You will mentor junior pentesters and contribute to a central repository of testing methods, while continuously optimizing

Qualifications

• 5+ years of experience in offensive security, including strategic planning and hands-on execution across cloud, web, APIs, and devices.
• Bachelor's degree in Computer Science, Information Systems, or related field preferred.
• Solid background in vulnerability assessment and penetration testing.
• Solid knowledge of OWASP Top 10 and SDLC methodologies.
• Experience automating security controls (e.g., shell scripting, Python).
• Strong communication to explain vulnerabilities to technical and non-technical stakeholders.
• Industry certifications such as SANS GIAC, OSCP, CISSP, CISA, CISM or ISO27001 Lead Auditor are valued.
• Knowledge of AI/ML security risks and offensive agentic AI is highly valued.

Responsibilities

• Design, prioritise, and lead internal penetration testing across the product portfolio (digital, cloud, medical devices).
• Identify and assess vulnerabilities; help product teams prioritise and fix them throughout the lifecycle.
• Provide strategic technical support and security knowledge during design and development to ensure security by design.
• Mentor and coach junior and mid-level pentesters in advanced testing techniques.
• Contribute to central testing methods and tools repository for reuse across the business.
• Support Incident Response with technical analysis and forensics.
• Execute red team exercises to assess resilience of products and solutions.
• Prepare and present security reports with risk assessments and actionable recommendations.
• Promote defence and security-by-design across product lines.
• Continuously optimise processes, playbooks, and tools for scalable product security.
• Explore and integrate AI-enabled offensive testing capabilities to simulate sophisticated threats.

Skills

Offensive security

Strategic planning

Hands-on execution

Leadership

Education

Bachelor's degree in CS/IS or related field

Tools

Shell scripting

Python

Vulnerability assessment tools

Job description

Roche is seeking a Senior Penetration Tester to join our Product Security & Privacy Organization (PSPO). In this hands-on role, you will lead vulnerability assessments and penetration testing across Roche’s digital solutions, cloud applications, and medical devices, collaborating with engineering and architecture teams to strengthen cyber defenses and ensure patient safety.

You will mentor junior pentesters and contribute to a central repository of testing methods, while continuously optimizing