Senior Penetration Testing Program Lead, Medical Devices

Antler Co; Raynham (MA); On-site; USD 94,000 - 170,000; Full time

Job summary

Johnson & Johnson is seeking a seasoned Professional, Program Lead, Penetration Testing Services to guide the testing program across DePuy Synthes product portfolios. The role oversees methodology, scoping, and engagement models to embed Secure by Design across medical devices, firmware, apps, APIs, and cloud services.

The incumbent manages internal testers and external partners, translating findings into patient safety and business risk, and drives remediation with R&D and engineering teams,

Qualifications

• Minimum 6 years of progressive experience in penetration testing and offensive security.
• Experience leading a penetration testing program with methodology and vendor oversight.
• Hands-on proficiency across web, API, mobile, network, wireless, and cloud testing.
• Proficiency with Burp Suite, Metasploit, Nmap, Wireshark, Ghidra/IDA, and Kali; scripting in Python/PowerShell.
• Excellent written and verbal communication to translate findings for non-technical audiences.

Responsibilities

• Own the end-to-end penetration testing services program, including roadmap and capacity planning.
• Define testing methodology, scoping standards, rules of engagement, and reporting templates.
• Embed Secure by Design verification into the product development lifecycle.
• Execute and oversee assessments across devices, firmware, apps, APIs, and cloud.
• Manage third-party testers and vendors, including SLAs and quality review.
• Triage findings, assess exploitability, and translate risk for stakeholders.
• Drive remediation with R&D and engineering through retest and closure.
• Conduct threat modeling and attack surface analysis for engagement planning.
• Support regulatory submissions with testing evidence for FDA/EU requirements.
• Contribute testing results to product security risk files and governance reports.
• Build program metrics and report findings to leadership.

Skills

Penetration testing

Offensive security

Red team

Web API testing

Mobile testing

Cloud security testing

Scripting (Python, PowerShell)

Education

Bachelor's degree in Computer Science or related field

Tools

Burp Suite

Metasploit

Nmap

Wireshark

Ghidra/IDA

Kali Linux

Job description

Johnson & Johnson is seeking a seasoned Professional, Program Lead, Penetration Testing Services to guide the testing program across DePuy Synthes product portfolios. The role oversees methodology, scoping, and engagement models to embed Secure by Design across medical devices, firmware, apps, APIs, and cloud services.

The incumbent manages internal testers and external partners, translating findings into patient safety and business risk, and drives remediation with R&D and engineering teams,