Penetration Testing Program Lead

Johnson & Johnson MedTech; Warsaw (IN); On-site; USD 94,000 - 170,000; Full time

Job summary

Johnson & Johnson MedTech is seeking a Professional, Program Lead, Penetration Testing Services to lead the security testing program for the DePuy Synthes product portfolio. The role defines testing methodology, scope, and engagement models spanning medical devices, embedded firmware, mobile apps, APIs, and cloud services.

The Program Lead will manage internal testers and external partners, translate findings into patient-safety risk, drive remediation with R&D and engineering, and report

Qualifications

• Minimum 6 years of progressive experience in penetration testing, offensive security, red teaming, or application security assessment.
• Demonstrated experience leading or managing a penetration testing program, including methodology definition, scoping standards, and vendor oversight.
• Hands-on proficiency across web app, API, mobile, network, wireless, and cloud penetration testing.

Responsibilities

• Own end-to-end penetration testing services program, roadmap, and capacity planning across resources.
• Define and maintain testing methodology, scoping, and engagement rules aligned to OWASP/NIST frameworks.
• Embed security testing gates into the product development lifecycle for Secure by Design verification.
• Execute assessments across medical devices, firmware, mobile apps, APIs, and cloud infrastructure.
• Manage third-party testers and vendors with SOW development and SLA performance review.
• Triage findings, assess risk to patient safety, and drive remediation with R&D and engineering.

Skills

Penetration testing

Offensive security

Red teaming

Application security

Security testing tools

Education

Bachelor's degree in CS/Cybersecurity

Advanced cybersecurity education (preferred)

Tools

Burp Suite

Metasploit

Nmap

Wireshark

Ghidra/IDA

Kali

Job description

Johnson & Johnson MedTech is seeking a Professional, Program Lead, Penetration Testing Services to lead the security testing program for the DePuy Synthes product portfolio. The role defines testing methodology, scope, and engagement models spanning medical devices, embedded firmware, mobile apps, APIs, and cloud services.

The Program Lead will manage internal testers and external partners, translate findings into patient-safety risk, drive remediation with R&D and engineering, and report