PenTesting Program Lead — Secure by Design

Johnson & Johnson Innovative Medicine; Town of Florida (NY); On-site; USD 94,000 - 170,000; Full time

Job summary

Johnson & Johnson is seeking a seasoned Professional, Program Lead, Penetration Testing Services to build and operate the end‑to‑end testing program across medical devices, firmware, mobile apps, APIs, and cloud services. You will define methodology, engage vendors, and drive remediation with R&D and engineering teams.

The role requires 6+ years in penetration testing, strong leadership, and the ability to translate findings into patient safety and business risk for senior stakeholders.

Qualifications

• Minimum 6 years of progressive experience in penetration testing, offensive security, red teaming, or application security assessment.
• Demonstrated experience leading or managing a penetration testing program, including methodology definition, scoping standards, and vendor oversight.
• Hands-on proficiency across multiple domains: web application, API, mobile, network, wireless, and cloud penetration testing.

Responsibilities

• Own the end-to-end penetration testing services program for products and connected platforms, including the annual testing roadmap, prioritization model, and capacity planning across internal and external resources.
• Define and maintain the penetration testing methodology, scoping standards, rules of engagement, and reporting templates aligned to industry frameworks (OWASP, PTES, NIST SP 800-115, MITRE ATT&CK).
• Embed security testing gates into the product development lifecycle, ensuring Secure by Design verification occurs at defined design, integration, and pre-release milestones.
• Execute and oversee hands-on assessments across medical devices, embedded firmware, wireless protocols, mobile applications, web applications, APIs, and cloud infrastructure.
• Manage third-party penetration testing vendors — including scoping, statement of work development, quality review of deliverables, and performance management against SLAs.
• Triage and validate findings, assess exploitability, and evaluate patient safety and clinical impact in partnership with Product Security, Quality, and Regulatory stakeholders.
• Drive remediation with R&D and engineering teams, tracking findings through retest and verified closure, and escalating overdue or elevated risks through governance channels.
• Conduct threat modeling and attack surface analysis to inform test scoping and identify high-value targets prior to engagement.
• Support regulatory and customer requirements by producing testing evidence for FDA premarket submissions, EU MDR technical files, and hospital security assessments.
• Contribute penetration testing results and residual risk analysis into product security risk files aligned to AAMI TIR57 and ISO 14971.
• Build and report program metrics — test coverage across the portfolio, finding severity distribution, remediation aging, and retest pass rates — to leadership and product stakeholders.
• Research emerging attack techniques, medical device vulnerabilities, and tooling; continuously evolve the testing capability and develop custom tooling and exploits where needed.
• Assess the testing implications of platform migrations, supplier changes, and separation/carve-out activity affecting the product portfolio and supporting infrastructure.
• Deliver technical enablement and secure development training to engineering teams, using real findings to strengthen security ownership and cyber culture.

Skills

Penetration testing

Offensive security

Red teaming

Communication

SDLC security integration

Leadership

Education

Bachelor’s degree in Computer Science/Cybersecurity/Engineering/Information Systems

Tools

Burp Suite

Metasploit

Nmap

Wireshark

Ghidra/IDA

Kali

Job description

Johnson & Johnson is seeking a seasoned Professional, Program Lead, Penetration Testing Services to build and operate the end‑to‑end testing program across medical devices, firmware, mobile apps, APIs, and cloud services. You will define methodology, engage vendors, and drive remediation with R&D and engineering teams.

The role requires 6+ years in penetration testing, strong leadership, and the ability to translate findings into patient safety and business risk for senior stakeholders.