Professional, Prog Lead, PenTesting Svcs

Johnson & Johnson Co.; New Brunswick (NJ); On-site; USD 94,000 - 152,000; Full time

Job summary

Johnson & Johnson is seeking a seasoned Professional, Program Lead for Penetration Testing Services to build and run the offensive security program across the DePuy Synthes product portfolio. You will set testing methodology, engage internal testers and third‑party partners, and translate findings into patient safety and business risk insights.

Responsibilities include defining engagement models, embedding Secure by Design across the lifecycle, and driving remediation with R&D and engineering

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Software/Electrical/Biomedical Engineering, Information Systems, or related technical discipline.
• Advanced cybersecurity education is preferred.
• Minimum 6 years of progressive experience in penetration testing, offensive security, red teaming, or app security assessment.

Responsibilities

• Own the end-to-end penetration testing services program for products and connected platforms, including the annual testing roadmap and capacity planning.
• Define and maintain the penetration testing methodology, scoping standards, rules of engagement, and reporting templates aligned to OWASP, PTES, NIST SP 800-115, MITRE ATT&CK.
• Embed security testing gates into the product development lifecycle to ensure Secure by Design verification at milestones.
• Execute and oversee hands-on assessments across medical devices, firmware, wireless protocols, mobile apps, APIs, and cloud infrastructure.
• Manage third-party penetration testing vendors, including scoping, SOW development, quality review, and SLA performance.
• Triage and validate findings, assess exploitability, and evaluate patient safety and clinical impact with stakeholders.
• Drive remediation with R&D and engineering and track through retests and closure.

Skills

Penetration testing

Offensive security

Vendor management

Secure SDLC

Python scripting

Education

Bachelor's degree in Computer Science, Cybersecurity, or related

Tools

Burp Suite

Metasploit

Nmap

Wireshark

Ghidra/IDA

Kali

Job description

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at jnj.com

As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit.

Job Function: Technology Enterprise Strategy & Security

Job Sub Function: Solution Architecture

Job Category: Scientific/Technology

All Job Posting Locations: New Brunswick, New Jersey, United States of America, Palm Beach Gardens, Florida, United States of America, Raynham, Massachusetts, United States of America, Warsaw, Indiana, United States of America, West Chester, Pennsylvania, United States of America

Job Description

Job Overview

The Professional, Program Lead, Penetration Testing Services is a seasoned individual contributor within the Cybersecurity function, Product Security sub-function, accountable for building and running the penetration testing and offensive security services program for the DePuy Synthes product portfolio. This role establishes the testing methodology, scoping standards, and engagement model that embed Secure by Design verification into the product development lifecycle — spanning medical devices, embedded firmware, mobile applications, APIs, and supporting cloud services. The Program Lead manages internal testers and third‑party assessment partners, translates technical findings into patient safety and business risk, and drives remediation to closure with R&D and engineering teams. Applying advanced technical skills and industry-leading practices, this role serves as the authoritative voice on product security testing across the enterprise.

Key Responsibilities

• Own the end-to-end penetration testing services program for products and connected platforms, including the annual testing roadmap, prioritization model, and capacity planning across internal and external resources.
• Define and maintain the penetration testing methodology, scoping standards, rules of engagement, and reporting templates aligned to industry frameworks (OWASP, PTES, NIST SP 800-115, MITRE ATT&CK).
• Embed security testing gates into the product development lifecycle, ensuring Secure by Design verification occurs at defined design, integration, and pre-release milestones.
• Execute and oversee hands‑on assessments across medical devices, embedded firmware, wireless protocols, mobile applications, web applications, APIs, and cloud infrastructure.
• Manage third‑party penetration testing vendors—including scoping, statement of work development, quality review of deliverables, and performance management against SLAs.
• Triage and validate findings, assess exploitability, and evaluate patient safety and clinical impact in partnership with Product Security, Quality, and Regulatory stakeholders.
• Drive remediation with R&D and engineering teams, tracking findings through retest and verified closure, and escalating overdue or elevated risks through governance channels.
• Conduct threat modeling and attack surface analysis to inform test scoping and identify high‑value targets prior to engagement.
• Support regulatory and customer requirements by producing testing evidence for FDA premarket submissions, EU MDR technical files, and hospital security assessments.
• Contribute penetration testing results and residual risk analysis into product security risk files aligned to AAMI TIR57 and ISO 14971.
• Build and report program metrics— test coverage across the portfolio, finding severity distribution, remediation aging, and retest pass rates—to leadership and product stakeholders.
• Research emerging attack techniques, medical device vulnerabilities, and tooling; continuously evolve the testing capability and develop custom tooling and exploits where needed.
• Assess the testing implications of platform migrations, supplier changes, and separation/carve‑out activity affecting the product portfolio and supporting infrastructure.
• Deliver technical enablement and secure development training to engineering teams, using real findings to strengthen security ownership and cyber culture.

Qualifications

• Education Bachelor's degree in Computer Science, Cybersecurity, Software/Electrical/ Biomedical Engineering, Information Systems, or a related technical discipline.
• Advanced degree or specialized cybersecurity education (preferred).
• Experience and Skills Required: Minimum 6 years of progressive experience in penetration testing, offensive security, red teaming, or application security assessment. Demonstrated experience leading or managing a penetration testing program, including methodology definition, scoping standards, and vendor oversight. Hands‑on proficiency across multiple domains: web application, API, mobile, network, wireless, and cloud penetration testing. Working knowledge of common testing tools and frameworks (Burp Suite, Metasploit, Nmap, Wireshark, Ghidra/IDA, Kali) and scripting proficiency (Python, Bash, PowerShell). Strong understanding of vulnerability classes and taxonomies (OWASP Top 10, CWE) and risk scoring methodologies (CVSS). Experience embedding security testing into an SDLC and driving remediation with engineering teams through verified closure. Excellent written and verbal communication skills, with proven ability to translate technical exploitation detail into business and patient safety risk for non-technical audiences. Preferred: MedTech or medical device experience; familiarity with FDA premarket/postmarket cybersecurity guidance, EU MDR, IEC 62304, ISO 14971, and AAMI TIR57. Embedded systems and firmware security experience, including hardware interfaces (JTAG/UART), secure boot, and reverse engineering. Experience testing wireless and IoMT protocols (Bluetooth/BLE, Zigbee, RF, proprietary protocols). Experience supporting product security testing within a divestiture, carve‑out, or standalone entity stand‑up. Cloud penetration testing experience in AWS and/or Azure environments. Exposure to coordinated vulnerability disclosure programs and researcher engagement. Experience applying Generative AI / LLM-enabled tooling to accelerate reconnaissance, code review, and reporting workflows. Experience integrating automated security testing into DevSecOps and CI/CD pipelines.
• Other: Travel: Up to 10% domestic and international travel expected for lab‑based device testing and site engagements. Language: English proficiency required.

Required Skills

• Business Alignment, Business Architecture, Business Requirements Analysis, Coaching, Consulting, Critical Thinking, Emerging Technologies, Information Security Management System (ISMS), Information Technology Strategies, Information Technology Trends, IT Architecture, Management Systems Implementation, Problem Solving, Requirements Analysis, Solution Architecture, Technical Credibility, Technical Writing, Technologically Savvy

Preferred Skills

• Business Alignment, Business Architecture, Business Requirements Analysis, Coaching, Consulting, Critical Thinking, Emerging Technologies, Information Security Management System (ISMS), Information Technology Strategies, Information Technology Trends, IT Architecture, Management Systems Implementation, Problem Solving, Requirements Analysis, Solution Architecture, Technical Credibility, Technical Writing, Technologically Savvy

Compensation and Benefits

The anticipated base pay range for this position is : $94,000.00 - $151,800.00 Additional Description for Pay Transparency: Subject to the terms of their respective plans, employees are eligible to participate in the Company’s consolidated retirement plan (pension) and savings plan (401(k)). This position is eligible to participate in the Company’s long-term incentive program. Subject to the terms of their respective policies and date of hire, employees are eligible for the following time off benefits: Vacation –120 hours per calendar year Sick time - 40 hours per calendar year; for employees who reside in the State of Colorado –48 hours per calendar year; for employees who reside in the State of Washington –56 hours per calendar year Holiday pay, including Floating Holidays –13 days per calendar year Work, Personal and Family Time - up to 40 hours per calendar year Parental Leave – 480 hours within one year of the birth/adoption/foster care of a child Bereavement Leave – 240 hours for an immediate family member: 40 hours for an extended family member per calendar year Caregiver Leave – 80 hours in a 52‑week rolling period10 days Volunteer Leave – 32 hours per calendar year Military Spouse Time-Off – 80 hours per calendar year Additional information can be found through the link below.

Co‑Ops and Intern Positions: Please use the following language: Co‑Ops/Interns are eligible to participate in Company sponsored employee medical benefits in accordance with the terms of the plan. Co‑Ops and Interns are eligible for the following sick time benefits: up to 40 hours per calendar year; for employees who reside in the State of Washington, up to 56 hours per calendar year. Co‑Ops and Interns are eligible to participate in the Company’s consolidated retirement plan (pension).

Positions Represented by CBA: Please use the following language: This position is eligible for benefits to include medical, dental, vision and time off, as well as any others as provided for in the applicable Collective Bargaining Agreement. The following link to general company benefits information MUST also be included in the posting: Please use the following language: For additional general information on Company benefits, please go to: - https://www.careers.jnj.com/employee-benefits

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at https://www.jnj.com/.