Senior PenTesting Program Lead

Antler Co; Warsaw (IN); On-site; USD 94,000 - 170,000; Full time

Benefits offered by this job

Travel up to 10%

Job summary

Johnson & Johnson is seeking a Senior Professional, Program Lead for Penetration Testing Services to build and run the offensive security program across the DePuy Synthes product portfolio. The role defines testing methodology, scopes engagement, and embeds Secure by Design into medical devices, firmware, apps, APIs, and cloud services.

You will lead internal testers and partners, translate findings into patient safety risk, and drive remediation with R&D and engineering teams.

Qualifications

• Minimum 6 years in penetration testing, offensive security or app security assessment.
• Experience leading a pentesting program including methodology and vendor oversight.
• Hands-on across web, API, mobile, cloud, and network testing.
• Proficiency with common tools and scripting languages.
• Excellent written and verbal communication for risk translation.

Responsibilities

• Own end-to-end penetration testing services program and roadmap.
• Define testing methodology, scoping, and engagement rules.
• Embed security gates into the product lifecycle for Secure by Design.
• Execute and oversee assessments across devices, apps, and cloud.
• Manage third-party testers and vendors, ensure timely deliverables.
• Translate findings into patient safety and business risk.
• Drive remediation with R&D and engineering teams through verification.

Skills

Penetration testing

Offensive security

Red teaming

Vendor oversight

Breach response

Threat modeling

Secure SDLC

Communication

Python

Kali

Burp Suite

Metasploit

Nmap

Ghidra/IDA

Cloud security

Education

Bachelor's degree

Advanced cybersecurity education

Tools

Burp Suite

Metasploit

Nmap

Wireshark

Ghidra/IDA

Kali

Python

Bash

PowerShell

Job description

Johnson & Johnson is seeking a Senior Professional, Program Lead for Penetration Testing Services to build and run the offensive security program across the DePuy Synthes product portfolio. The role defines testing methodology, scopes engagement, and embeds Secure by Design into medical devices, firmware, apps, APIs, and cloud services.

You will lead internal testers and partners, translate findings into patient safety risk, and drive remediation with R&D and engineering teams.