Professional, Prog Lead, PenTesting Svcs

We need to output HTML fragment with sections: About the role? The posting includes "Job Overview" which is like About the role. Also "Key Responsibilities" -> Responsibilities. "Qualifications" -> Qualifications. Also "Preferred Skills" list maybe under Skills? There's a "Preferred Skills:" list. Also "Other" includes Travel, Language, Certifications. Those could be under Requirements? But we should only include sections with real content. We have Pay: "The anticipated base pay range for this position is : 94,000.00 - 170,000.00 USD Annual". So we need a Pay section. Schedule? Not present. Benefits: there is a block about benefits (vacation, sick time, etc). So Benefits section. We must not repeat job title as heading. Use

for each section heading. We need to preserve all substantive info, not invent. We need to use

• for any list of duties/requirements/benefits. We need

  for prose. We must remove boilerplate: navigation, legal, EEO, etc. The posting includes some boilerplate at start: "At Johnson & Johnson, we believe health is everything..." That's corporate fluff but maybe considered boilerplate? It's not specific to role. Likely we should remove that as it's generic. Also "Learn more at jnj.com". Also "As guided by Our Credo..." etc. Probably remove. We need to keep job function etc? Those are metadata; we can fold minor metadata into a short

  or drop it. The job function etc maybe not needed. We can include a short paragraph with location list? The posting includes "All Job Posting Locations: ..." That's location info; we could include in a

  under maybe "Location". But we don't have a heading for Location unless we create a section; but we only create sections when there is real specific content. Could we include location in a

  under "About the role"? Probably better to include a short paragraph after overview. We need to include "Job Overview" as About the role. Use

  About the role

  then

  with overview text. Key Responsibilities ->

  Responsibilities

  then
  • each. Qualifications ->

    Qualifications

    then maybe split into Education and Experience? Could keep as

    for education then

    for experience/skills? But rule: use
    • for any list of duties/requirements/benefits. Qualifications includes education (not a list) and required experience and skills (list). We can do

      for education paragraph, then

      for required experience and skills. Also preferred skills list maybe under Skills section. We have a "Preferred Skills:" list after "Other". That's a list of skills. Could be under

      Skills

      with
      . Pay section:

      Pay

      The anticipated base pay range for this position is : 94,000.00 - 170,000.00 USD Annual

      Benefits section:

      Benefits

      then
      with each benefit line. We also have Travel, Language, Certifications under "Other". Could be under Requirements? Might be better to include a short

      under Qualifications or a separate section "Other Requirements". But we should not create thin sections. Could combine them into a

      under Qualifications after required experience? Or maybe under a section "Additional Requirements". However the instruction: Prefer a few substantive sections over many thin ones. So we could add a section "Other Requirements" if we have multiple items: Travel, Language, Certifications. That's three items; could be a

      . That seems substantive enough. Thus sections: About the role, Responsibilities, Qualifications, Skills, Pay, Benefits, Other Requirements. Check if any content duplicated: Ensure we preserve all substantive info. Let's extract text. About the role (Job Overview): "The Professional, Program Lead, Penetration Testing Services is a seasoned individual contributor within the Cybersecurity function, Product Security sub-function, accountable for building and running the penetration testing and offensive security services program for the DePuy Synthes product portfolio. This role establishes the testing methodology, scoping standards, and engagement model that embed Secure by Design verification into the product development lifecycle — spanning medical devices, embedded firmware, mobile applications, APIs, and supporting cloud services. The Program Lead manages internal testers and third-party assessment partners, translates technical findings into patient safety and business risk, and drives remediation to closure with R&D and engineering teams. Applying advanced technical skills and industry-leading practices, this role serves as the authoritative voice on product security testing across the enterprise." That's the overview. Responsibilities list from "Key Responsibilities": - Own the end-to-end penetration testing services program for products and connected platforms, including the annual testing roadmap, prioritization model, and capacity planning across internal and external resources. - Define and maintain the penetration testing methodology, scoping standards, rules of engagement, and reporting templates aligned to industry frameworks (OWASP, PTES, NIST SP 800-115, MITRE ATT&CK). - Embed security testing gates into the product development lifecycle, ensuring Secure by Design verification occurs at defined design, integration, and pre-release milestones. - Execute and oversee hands-on assessments across medical devices, embedded firmware, wireless protocols, mobile applications, web applications, APIs, and cloud infrastructure. - Manage third-party penetration testing vendors — including scoping, statement of work development, quality review of deliverables, and performance management against SLAs. - Triage and validate findings, assess exploitability, and evaluate patient safety and clinical impact in partnership with Product Security, Quality, and Regulatory stakeholders. - Drive remediation with R&D and engineering teams, tracking findings through retest and verified closure, and escalating overdue or elevated risks through governance channels. - Conduct threat modeling and attack surface analysis to inform test scoping and identify high-value targets prior to engagement. - Support regulatory and customer requirements by producing testing evidence for FDA premarket submissions, EU MDR technical files, and hospital security assessments. - Contribute penetration testing results and residual risk analysis into product security risk files aligned to AAMI TIR57 and ISO 14971. - Build and report program metrics — test coverage across the portfolio, finding severity distribution, remediation aging, and retest pass rates — to leadership and product stakeholders. - Research emerging attack techniques, medical device vulnerabilities, and tooling; continuously evolve the testing capability and develop custom tooling and exploits where needed. - Assess the testing implications of platform migrations, supplier changes, and separation/carve-out activity affecting the product portfolio and supporting infrastructure. - Deliver technical enablement and secure development training to engineering teams, using real findings to strengthen security ownership and cyber culture. Qualifications: Education: "Bachelor's degree in Computer Science, Cybersecurity, Software/Electrical/ Biomedical Engineering, Information Systems, or a related technical discipline. Advanced degree or specialized cybersecurity education (preferred)." Required Experience and Skills list: - Minimum 6 years of progressive experience in penetration testing, offensive security, red teaming, or application security assessment. - Demonstrated experience leading or managing a penetration testing program, including methodology definition, scoping standards, and vendor oversight. - Hands-on proficiency across multiple domains: web application, API, mobile, network, wireless, and cloud penetration testing. - Working knowledge of common testing tools and frameworks (Burp Suite, Metasploit, Nmap, Wireshark, Ghidra/IDA, Kali) and scripting proficiency (Python, Bash, PowerShell). - Strong understanding of vulnerability classes and taxonomies (OWASP Top 10, CWE) and risk scoring methodologies (CVSS). - Experience embedding security testing into an SDLC and driving remediation with engineering teams through verified closure. - Excellent written and verbal communication skills, with proven ability to translate technical exploitation detail into business and patient safety risk for non-technical audiences. Preferred (maybe under Skills): list after "Preferred MedTech or medical device experience; ..." and then many bullet-like items separated by semicolons. Also after "Other" there is "Preferred Skills: Business Alignment, Business Architecture, ..." That's a separate list. We need to capture all preferred skills items. Let's parse the preferred skills section: After "Preferred MedTech or medical device experience; familiarity with FDA premarket/postmarket cybersecurity guidance, EU MDR, IEC 62304, ISO 14971, and AAMI TIR57. Embedded systems and firmware security experience, including hardware interfaces (JTAG/UART), secure boot, and reverse engineering. Experience testing wireless and IoMT protocols (Bluetooth/BLE, Zigbee, RF, proprietary protocols). Experience supporting product security testing within a divestiture, carve-out, or standalone entity stand-up. Cloud penetration testing experience in AWS and/or Azure environments. Exposure to coordinated vulnerability disclosure programs and researcher engagement. Experience applying Generative AI / LLM-enabled tooling to accelerate reconnaissance, code review, and reporting workflows. Experience integrating automated security testing into DevSecOps and CI/CD pipelines." Then later: "Other Travel: Up to 10% domestic and international travel expected for lab-based device testing and site engagements. Language: English proficiency required. Certifications: OSCP, OSCE, GPEN, GWAPT, or GXPN required or in progress. OSWE, GRTP, CRTO, or CISSP preferred." Then after that: "For more information on how we support the whole health of our employees throughout their wellness, career and life journey, please visit www.careers.jnj.com." Then "Required Skills Preferred Skills: Business Alignment, Business Architecture, Business Requirements Analysis, Coaching, Consulting, Critical Thinking, Emerging Technologies, Information Security Management System (ISMS), Information Technology Strategies, Information Technology Trends, IT Architecture, Management Systems Implementation, Problem Solving, Requirements Analysis, Solution Architecture, Technical Credibility, Technical Writing, Technologically Savvy" Thus we have two preferred skills lists: one more technical, another generic business skills. We should combine them under Skills section. Thus Skills section:
      with all those items. We need to ensure we don't miss any. Let's list them: From first preferred block: - MedTech or medical device experience - Familiarity with FDA premarket/postmarket cybersecurity guidance - Familiarity with EU MDR - Familiarity with IEC 62304 - Familiarity with ISO 14971 - Familiarity with AAMI TIR57 - Embedded systems and firmware security experience, including hardware interfaces (JTAG/UART), secure boot, and reverse engineering - Experience testing wireless and IoMT protocols (Bluetooth/BLE, Zigbee, RF, proprietary protocols) - Experience supporting product security testing within a divestiture, carve-out, or standalone entity stand-up - Cloud penetration testing experience in AWS and/or Azure environments - Exposure to coordinated vulnerability disclosure programs and researcher engagement - Experience applying Generative AI / LLM-enabled tooling to accelerate reconnaissance, code review, and reporting workflows - Experience integrating automated security testing into DevSecOps and CI/CD pipelines From second list (after "Required Skills Preferred Skills:"): - Business Alignment - Business Architecture - Business Requirements Analysis - Coaching - Consulting - Critical Thinking - Emerging Technologies - Information Security Management System (ISMS) - Information Technology Strategies - Information Technology Trends - IT Architecture - Management Systems Implementation - Problem Solving - Requirements Analysis - Solution Architecture - Technical Credibility - Technical Writing - Technologically Savvy We should also include maybe "Required Skills" but that heading is weird; we treat as skills. Now Benefits: list from block: - Vacation –120 hours per calendar year - Sick time - 40 hours per calendar year; for employees who reside in the State of Colorado –48 hours per calendar year; for employees who reside in the