# Cybersecurity Penetration Tester
At Roche, we are passionate about transforming patients' lives through innovation.
Задачи (Responsibilities)
We're looking for a Penetration Tester to join our Product Security & Privacy Organization (PSPO) — a dynamic global team ensuring the resilience and trustworthiness of Roche's products and digital solutions. In this hands-on role, you'll execute vulnerability assessments and penetration testing activities across our physical and cloud-based products under the guidance of senior team members. You'll collaborate with engineering, product, and architecture teams to strengthen Roche's cyber defenses and ensure that innovation in diagnostics goes hand in hand with security and patient safety.
•Conduct and participate in penetration testing activities across our diverse product portfolio, including digital solutions, cloud applications, and medical devices.
•Proactively identify and assess vulnerabilities, and collaborate with product teams to prioritize and fix them throughout the product lifecycle.
•Provide technical support and security knowledge to product teams during the design and development phases to ensure security by design.
•Collaborate with the team to contribute to, utilize, and help maintain the central repository of testing methods and tools, supporting reusability across the business.
•Support the Incident Response team with technical analysis and forensics during security incidents.
•Execute red team exercises to assess product and solution resilience.
•Prepare and present clear security reports with risk assessments and actionable recommendations.
•Contribute to integrating defense and security-by-design principles across product lines.
•Continuously optimize processes, playbooks, and tools for scalable product security.
•Leverage AI-assisted security tools and emerging technologies to enhance the efficiency, scope, and coverage of vulnerability assessments.
Требования (Requirements)
You are a technically strong, curious, and impact-driven professional who thrives in complex, fast-moving environments. You enjoy uncovering vulnerabilities and turning insights into stronger, safer products.
•Proven experience (2+ years) leading and executing penetration testing across web applications, APIs, cloud environments, and/or embedded devices; or demonstrated expert-level offensive skills acquired in a highly specialized security domain.
•Bachelor's degree in Computer Science, Information Systems, or a related field preferred.
•Solid background in vulnerability assessment and penetration testing.
•Solid knowledge of common attack vectors, security best practices (e.g., OWASP Top 10), and Secure Development Lifecycle (SDLC) methodologies.
•Experience automating security controls (e.g., shell scripting, Python).
•In-depth understanding of information security and privacy risks.
•Experience with incident response and forensics (a plus).
•Strong ability to communicate complex vulnerabilities, their impact, and required mitigation steps clearly to technical and non-technical stakeholders.
•Strong problem-solving, communication, teamwork, and leadership skills.
•Proactive, collaborative, and self-driven, focused on continuous learning and sharing knowledge within a diverse global team.
•Relevant industry certifications such as SANS GIAC (GCIH, GPEN, GCIA, GCFA), OSCP, OSEP, CEH, eJPT, CISSP, CISA, CISM, or ISO27001 Lead Auditor are highly valued.
•Knowledge of or keen interest in emerging AI technologies, including Large Language Models (LLMs) vulnerabilities and the basic concepts of offensive agentic AI.
•Shares Roche's core values: Customer Empathy, Trust, Ownership, Bias for Action, Curiosity, Optimism, Collaboration, and Data-driven Decision-Making.
Условия (Conditions)
This is an opportunity to shape the future of healthcare technology, strengthen the security of life-saving solutions, and directly protect patient trust. You'll collaborate with world-class teams, tackle meaningful challenges, and grow in a global environment that values learning, integrity, and innovation.
There is a preferred candidate identified for this role.
