Professional, Prog Lead, PenTesting Svcs

Johnson & Johnson

. Own the end-to-end penetration testing services program for products and connected platforms .

Posted 10/19/2026full-timeUnited StatesSenior💰 $94,000 - $151,800 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in penetration testing methodologies, including scoping standards and vendor management, while effectively embedding security testing into the product development lifecycle. Proficient in conducting assessments across various platforms and delivering technical training to engineering teams.

Highest-signal resume keywords

Penetration Testing Program ManagementWeb Application Penetration TestingScripting Proficiency in PythonOSCP CertificationThreat Modeling and Attack Surface Analysis

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Penetration TestingOffensive SecurityApplication Security AssessmentSecurity Testing MethodologyRemediation ManagementFDA Submission Evidence ProductionOWASP Top 10 UnderstandingCloud Penetration TestingMobile Penetration TestingNetwork Penetration Testing

Soft Skills

LeadershipCommunicationCollaborationProblem-SolvingTechnical Enablement

Tools & Technologies

Burp SuiteMetasploitNmapWiresharkGhidraIDAKali

Certifications & Qualifications

OSCPOSCEGPENGWAPTGXPN

Industry Keywords

Medical DevicesFirmwareWireless ProtocolsAPIsCloud InfrastructureSDLCPatient SafetyClinical ImpactRisk AnalysisEmerging Attack Techniques

Tech Stack

Tools & technologies

CloudCyber SecurityPythonSDLC

About the role

Key responsibilities & impact

Own the end-to-end penetration testing services program for products and connected platforms
Define penetration testing methodology, scoping standards, rules of engagement, and reporting templates
Embed security testing gates into the product development lifecycle
Execute and oversee assessments across medical devices, firmware, wireless protocols, mobile and web applications, APIs, and cloud infrastructure
Manage third-party penetration testing vendors and assess deliverables against SLAs
Triage and validate findings and evaluate patient safety and clinical impact
Drive remediation with R&D and engineering teams through verified closure
Conduct threat modeling and attack surface analysis
Produce testing evidence for FDA submissions, EU MDR technical files, and hospital security assessments
Contribute testing results and residual risk analysis to product security risk files
Build and report program metrics to leadership and product stakeholders
Research emerging attack techniques and develop custom tooling and exploits
Assess testing implications of migrations, supplier changes, and separation/carve-out activity
Deliver technical enablement and secure development training to engineering teams

Requirements

What you’ll need

Bachelor's degree in Computer Science, Cybersecurity, Software/Electrical/Biomedical Engineering, Information Systems, or a related technical discipline
Minimum 6 years of progressive experience in penetration testing, offensive security, red teaming, or application security assessment
Experience leading or managing a penetration testing program, including methodology definition, scoping standards, and vendor oversight
Hands-on proficiency in web application, API, mobile, network, wireless, and cloud penetration testing
Working knowledge of Burp Suite, Metasploit, Nmap, Wireshark, Ghidra/IDA, and Kali
Scripting proficiency in Python, Bash, and PowerShell
Understanding of OWASP Top 10, CWE, and CVSS
Experience embedding security testing into an SDLC and driving remediation through verified closure
English proficiency required
OSCP, OSCE, GPEN, GWAPT, or GXPN required or in progress
Up to 10% domestic and international travel expected

Benefits

Comp & perks

Consolidated retirement plan (pension)
Savings plan (401(k))
Long-term incentive program
Vacation – 120 hours per calendar year
Sick time – 40 hours per calendar year
Holiday pay, including Floating Holidays – 13 days per calendar year
Work, Personal and Family Time – up to 40 hours per calendar year
Parental Leave – 480 hours within one year of the birth/adoption/foster care of a child
Bereavement Leave – 240 hours for an immediate family member; 40 hours for an extended family member per calendar year
Caregiver Leave – 80 hours in a 52-week rolling period
Volunteer Leave – 32 hours per calendar year
Military Spouse Time-Off – 80 hours per calendar year