Professional, Prog Lead, PenTesting Svcs

Johnson & Johnson Innovative Medicine•New Brunswick, NJ

4d•$94,000 - $151,800

About The Position

DePuy Synthes is recruiting a Professional, Program Lead, Penetration Testing Services, located in New Brunswick, NJ; West Chester, PA; Palm Beach Gardens, FL; Warsaw, IN; or Raynham, MA. This seasoned individual contributor in Cybersecurity’s Product Security function is accountable for building and running the penetration testing and offensive security services program for the DePuy Synthes product portfolio. The role establishes testing methodology, scoping standards, and engagement models that embed Secure by Design verification into product development across medical devices, embedded firmware, mobile applications, APIs, and supporting cloud services. The Program Lead manages internal testers and third-party assessment partners, translates technical findings into patient safety and business risk, and drives remediation to closure with R&D and engineering teams. The role applies advanced technical skills and industry-leading practices and serves as the enterprise authority on product security testing. Up to 10% domestic and international travel is expected for lab-based device testing and site engagements. English proficiency is required.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Software, Electrical or Biomedical Engineering, Information Systems, or a related technical discipline.
At least 6 years of progressive experience in penetration testing, offensive security, red teaming, or application security assessment.
Demonstrated experience leading or managing a penetration testing program, including methodology definition, scoping standards, and vendor oversight.
Hands-on proficiency across multiple domains: web application, API, mobile, network, wireless, and cloud penetration testing.
Working knowledge of testing tools and frameworks such as Burp Suite, Metasploit, Nmap, Wireshark, Ghidra/IDA, and Kali, and scripting proficiency in Python, Bash, or PowerShell.
Strong understanding of vulnerability classes and taxonomies, including OWASP Top 10 and CWE, and risk scoring methodologies such as CVSS.
Experience embedding security testing into an SDLC and driving remediation with engineering teams through verified closure.
Excellent written and verbal communication skills, including ability to translate technical exploitation details into business and patient safety risk for non-technical audiences.
OSCP, OSCE, GPEN, GWAPT, or GXPN certification required or in progress.
English proficiency required.
Willingness to travel up to 10% domestically and internationally for lab-based device testing and site engagements.

Nice To Haves

Advanced degree or specialized cybersecurity education.
MedTech or medical device experience; familiarity with FDA premarket/postmarket cybersecurity guidance, EU MDR, IEC 62304, ISO 14971, and AAMI TIR57.
Embedded systems and firmware security experience, including hardware interfaces such as JTAG/UART, secure boot, and reverse engineering.
Experience testing wireless and IoMT protocols such as Bluetooth/BLE, Zigbee, RF, and proprietary protocols.
Experience supporting product security testing within a divestiture, carve-out, or standalone entity stand-up.
Cloud penetration testing experience in AWS and/or Azure environments.
Exposure to coordinated vulnerability disclosure programs and researcher engagement.
Experience applying Generative AI or LLM-enabled tooling to accelerate reconnaissance, code review, and reporting workflows.
Experience integrating automated security testing into DevSecOps and CI/CD pipelines.
OSWE, GRTP, CRTO, or CISSP certification preferred.

Responsibilities

Own the end-to-end penetration testing services program for products and connected platforms, including the annual testing roadmap, prioritization model, and capacity planning across internal and external resources.
Define and maintain penetration testing methodology, scoping standards, rules of engagement, and reporting templates aligned with OWASP, PTES, NIST SP 800-115, and MITRE ATT&CK.
Embed security testing gates into the product development lifecycle, ensuring Secure by Design verification at defined design, integration, and pre-release milestones.
Execute and oversee hands-on assessments of medical devices, embedded firmware, wireless protocols, mobile and web applications, APIs, and cloud infrastructure.
Manage third-party penetration testing vendors, including scoping, statement of work development, quality review of deliverables, and performance management against SLAs.
Triage and validate findings, assess exploitability, and evaluate patient safety and clinical impact with Product Security, Quality, and Regulatory stakeholders.
Drive remediation with R&D and engineering teams, track findings through retest and verified closure, and escalate overdue or elevated risks through governance channels.
Conduct threat modeling and attack surface analysis to inform test scoping and identify high-value targets before engagements.
Produce testing evidence to support FDA premarket submissions, EU MDR technical files, and hospital security assessments.
Contribute penetration testing results and residual risk analysis to product security risk files aligned with AAMI TIR57 and ISO 14971.
Build and report program metrics, including portfolio test coverage, finding severity distribution, remediation aging, and retest pass rates.
Research emerging attack techniques, medical device vulnerabilities, and tooling; continuously evolve testing capabilities and develop custom tooling and exploits as needed.
Assess testing implications of platform migrations, supplier changes, and separation or carve-out activity affecting the product portfolio and supporting infrastructure.
Deliver technical enablement and secure development training to engineering teams, using real findings to strengthen security ownership and cyber culture.

Benefits

Company consolidated retirement plan (pension).
401(k) savings plan.
Eligibility to participate in the long-term incentive program.
Vacation: 120 hours per calendar year, subject to applicable plan terms and date of hire.
Sick time: 40 hours per calendar year, with different amounts for eligible Colorado and Washington residents, subject to applicable policy terms and date of hire.
Holiday pay, including floating holidays: 13 days per calendar year, subject to applicable policy terms and date of hire.
Work, Personal and Family Time: up to 40 hours per calendar year, subject to applicable policy terms and date of hire.
Parental Leave: 480 hours within one year of a child’s birth, adoption, or foster care placement, subject to applicable policy terms and date of hire.
Bereavement Leave: up to 240 hours for an immediate family member and 40 hours for an extended family member per calendar year, subject to applicable policy terms and date of hire.
Caregiver Leave: 80 hours in a 52-week rolling period.
Volunteer Leave: 32 hours per calendar year, subject to applicable policy terms and date of hire.
Military Spouse Time-Off: 80 hours per calendar year, subject to applicable policy terms and date of hire.
Additional general company benefits information is available at https://www.careers.jnj.com/employee-benefits.