Professional, Prog Lead, PenTesting Svcs

Johnson & Johnson's DePuy Synthes division seeks a penetration testing program leader to design and manage offensive security services across medical devices, firmware, mobile applications, and cloud platforms. The role establishes testing methodology, embeds security gates into product development, manages internal and third-party testers, and translates technical findings into patient safety and business risk.

Responsibilities

• Own end-to-end penetration testing program including annual roadmap, prioritization, and capacity planning
• Define testing methodology, scoping standards, rules of engagement aligned to industry frameworks
• Embed security testing gates into product development lifecycle at design and pre-release milestones
• Manage third-party penetration testing vendors including scoping, SOW development, and performance oversight
• Drive remediation with engineering teams, track findings through closure, and escalate overdue risks

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or related technical discipline
• Minimum 6 years progressive penetration testing, offensive security, or application security assessment experience
• Demonstrated experience leading penetration testing program including methodology and vendor management
• Hands-on proficiency in web, API, mobile, network, wireless, and cloud penetration testing
• Proficiency with Burp Suite, Metasploit, Nmap, Wireshark, Ghidra/IDA, Kali and scripting languages
• Strong knowledge of OWASP Top 10, CWE, CVSS, and industry frameworks including NIST and MITRE ATT&CK