Medical Device Cybersecurity Penetration Tester

Job Title: Medical Device Cybersecurity Penetration Tester

Experience: 5+ years

Industry: Medical Devices / Healthcare Technology

Position Overview

We are seeking an experienced Cybersecurity Penetration Tester with specialized experience in medical devices and connected healthcare products. The individual will perform security assessments and penetration testing of medical device hardware, embedded systems, firmware, software, mobile applications, wireless interfaces, and cloud-connected platforms.

The role requires hands-on penetration testing capabilities combined with an understanding of medical device cybersecurity regulations, FDA requirements, EU regulatory expectations, and applicable industry standards.

The successful candidate will identify security vulnerabilities, evaluate potential patient safety and product security risks, and work closely with R&D, Systems Engineering, Software Engineering, Quality, and Regulatory teams to support cybersecurity throughout the medical device product lifecycle.

Key Responsibilities

• Perform security assessments and penetration testing of medical devices, including connected devices, embedded systems, firmware, operating systems, and device interfaces.
• Conduct application security testing of web applications, mobile applications, APIs, cloud platforms, and healthcare technology ecosystems connected to medical devices.
• Assess network and wireless communication security, including Wi-Fi, Bluetooth/BLE, USB, Ethernet, and other device communication interfaces.
• Identify and exploit security vulnerabilities, including authentication and authorization weaknesses, insecure data storage, encryption issues, privilege escalation, insecure communications, and firmware vulnerabilities.
• Perform vulnerability assessments, threat analysis, attack surface assessments, and security testing of device architectures.
• Evaluate cybersecurity risks associated with device functionality, patient safety, data integrity, availability, and confidentiality.
• Conduct firmware analysis, reverse engineering, and testing of embedded operating systems and hardware interfaces where applicable.
• Document vulnerabilities, proof-of-concept exploits, severity ratings, attack scenarios, and recommended remediation measures.
• Apply CVSS scoring and risk-based assessment methodologies to prioritize security findings.
• Collaborate with R&D and engineering teams to validate security fixes and perform regression testing.
• Support cybersecurity risk management activities, including threat modeling, security risk assessments, and security testing documentation.
• Prepare penetration testing reports and technical documentation to support FDA submissions, EU regulatory compliance, and medical device cybersecurity documentation.
• Support premarket and postmarket cybersecurity activities, vulnerability management, and security assessments throughout the product lifecycle.

Required Technical Skills and Tools

Penetration Testing & Vulnerability Assessment

• Hands-on experience with penetration testing methodologies, vulnerability discovery, exploitation, and security assessments.
• Experience with tools such as Burp Suite Professional, OWASP ZAP, Nmap, Nessus, OpenVAS, Metasploit, Kali Linux, Wireshark, and similar security testing tools.
• Knowledge of OWASP Top 10, OWASP API Security Top 10, and secure application testing practices.
• Experience with vulnerability analysis, CVE identification, CVSS scoring, and penetration testing reporting.

Medical Device & Embedded Systems Security

• Experience testing connected medical devices, embedded systems, firmware, and device communication interfaces.
• Knowledge of embedded Linux, Windows-based medical device platforms, RTOS, and other embedded operating systems.
• Experience with firmware analysis and reverse engineering tools such as Ghidra, IDA Pro, Binwalk, and hardware debugging interfaces such as JTAG, UART, and SWD.
• Understanding of wireless security protocols, including Wi-Fi, Bluetooth/BLE, and network communication protocols.
• Knowledge of secure boot, firmware updates, encryption, authentication, access control, and secure communication mechanisms.

Software, Cloud & Application Security

• Experience assessing web applications, mobile applications (iOS/Android), APIs, and cloud-connected medical device platforms.
• Knowledge of REST APIs, authentication mechanisms, OAuth, TLS, encryption, and secure data transmission.
• Familiarity with cloud security architectures and services such as AWS, Azure, or equivalent platforms.
• Understanding of software vulnerabilities, including SQL injection, cross-site scripting (XSS), insecure deserialization, and privilege escalation.

Medical Device Regulatory & Standards Knowledge

Working knowledge of applicable medical device cybersecurity regulations, guidance, and standards, including:

• FDA: FDA Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions; Section 524B of the FD&C Act; FDA postmarket cybersecurity guidance.
• EU MDR 2017/745: Medical device cybersecurity expectations, including Annex I General Safety and Performance Requirements (GSPRs).
• EU IVDR 2017/746: Cybersecurity considerations for applicable in vitro diagnostic medical devices.
• IEC 81001-5-1: Health software and health IT systems – Security activities in the product lifecycle.
• IEC 62443: Industrial automation and control systems cybersecurity principles, where applicable.
• ISO 14971: Medical device risk management and cybersecurity-related safety risk considerations.
• ISO 13485: Medical device quality management systems and design/development controls.
• IEC 62304: Medical device software lifecycle processes.
• IEC 82304-1: Health software product safety, where applicable.
• ISO/IEC 27001: Information security management systems.
• NIST Cybersecurity Framework and NIST SP 800-115: Security testing and assessment methodologies.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Computer Engineering, Information Security, or a related technical discipline.
• 5+ years of hands-on penetration testing, product security, or cybersecurity assessment experience.
• Demonstrated experience performing penetration testing on medical devices, healthcare technology products, or connected embedded systems.
• Strong understanding of medical device cybersecurity requirements and applicable FDA, EU MDR, and IEC/ISO standards.
• Experience with hardware, firmware, embedded systems, network, and application security testing.
• Ability to translate technical vulnerabilities into cybersecurity risks, patient safety implications, and actionable remediation recommendations.
• Strong technical documentation, vulnerability reporting, and cross-functional communication skills.

Preferred Qualifications

• Experience supporting medical device cybersecurity activities for FDA 510(k), De Novo, or PMA submissions.
• Experience with infusion pumps, patient monitoring systems, diagnostic equipment, imaging systems, wearable medical devices, or connected drug delivery systems.
• Relevant certifications such as OSCP, OSWE, GPEN, GXPN, GWAPT, or equivalent penetration testing certifications.
• Experience with medical device threat modeling, security architecture reviews, and cybersecurity risk management files.
• Familiarity with SBOM, CVE monitoring, vulnerability disclosure, and coordinated vulnerability management processes.

Important

This position requires hands-on medical device product security and penetration testing experience. General IT infrastructure, network, or enterprise application penetration testing experience alone will not be sufficient.

Pay: $52.00 - $65.00 per hour

Work Location: Remote