Senior Medical Device Penetration Tester

Lead medical device penetration tests from scoping to debrief, mentor other testers, and run deep-dive testing across medical devices, firmware, mobile apps, APIs, and cloud components, then translate findings into regulator-ready evidence.

Location Remote (United States), up to 40% client travel as required

Compensation Competitive, commensurate with experience, paid every two weeks, plus benefits including health, dental, vision, 401(k), and an educational allowance

Equipment Bring your own laptop and testing setup, and we cover the project-specific hardware and lab gear the work needs

• You lead medical device security tests from scoping to the final debrief, and still do hands-on testing.
• Senior: you set scope with clients, review other testers' findings, and mentor. Earlier in your career? See the Medical Device Penetration Tester job.
• Fully remote in the US, up to 40% travel, full time, with health, dental, vision, 401(k), and 10 paid holidays.

Your findings, and the findings of the testers you lead, decide whether a connected medical device is safe to reach patients. We are looking for a Senior Medical Device Penetration Tester who leads engagements, sets test scope with clients, mentors other testers, and takes pride in uncovering vulnerabilities that protect patient safety and advance secure innovation in healthcare technology. In this role you will execute deep-dive penetration tests across medical devices and their supporting systems, then translate complex findings into clear, actionable guidance aligned with FDA cybersecurity expectations.

Our mission is to secure medical innovation by delivering technical depth, clinical-risk awareness, and regulatory-aligned cybersecurity guidance. This role helps our clients ship devices that are secure, compliant, and safe for patients without slowing innovation.

This role requires strong technical proficiency, excellent communication, and an ownership-driven work style. You must be available for weekly team meetings, including client meetings.

• You have led penetration tests end to end and can turn an architecture diagram into a written test plan in an afternoon.
• You have pulled firmware, broken a pairing scheme, or chained small findings into a real attack path, and you can teach someone else to do it.
• You push back on a teammate's risk rating when the patient impact does not support it, and you explain why.
• You would rather tell a client their scope is too small than run a test that misses the thing that matters.

• Lead scoping calls and turn a client's architecture into a written test plan and rules of engagement.
• Own each engagement's quality: review teammates' findings, risk ratings, and evidence before reports go to clients.
• Mentor other testers on tradecraft, reporting, and how findings land in an FDA submission.
• Take the hardest devices and new device classes, and shape how we test them.

• Conduct penetration testing across medical devices, software platforms, firmware, mobile apps, APIs, cloud components, and supporting systems.
• Perform manual exploitation and advanced testing methods, not just scanner output.
• Maintain thorough notes, artifacts, and reproducible steps supporting each finding.

• Perform structured threat modeling using STRIDE, data flow diagram analysis, and attack surface mapping.
• Evaluate clinical and patient-safety risk impacts for vulnerabilities.
• Support cybersecurity risk assessments aligned with FDA secure development expectations.

• Write clear, technical, logically structured penetration test reports.
• Document proof-of-concept evidence, risk ratings, and remediation paths aligned to regulatory needs.
• Support evidence packages that feed into FDA submissions and secure SDLC documentation.

• Participate in scoping, kickoff, update, and debrief calls.
• Communicate blockers, clarifying questions, and status updates proactively.
• Work collaboratively with the delivery team to guide remediation.
• Update progress in Asana and maintain full transparency on timelines.
• Book and manage travel when required for onsite testing.

A typical day, so you can picture the work.

Morning Check Slack and Asana, then review a teammate's draft findings from a wearable test. You tighten a risk rating and ask for one more proof-of-concept…