Penetration Tester

About the role

Roche is looking for a Penetration Tester to join its Product Security & Privacy Organization (PSPO), a global team that ensures the resilience and trustworthiness of its products and digital solutions. The role is hands-on: you will run vulnerability assessments and penetration testing on physical and cloud-based products under the guidance of senior team members, working with engineering, product and architecture teams to strengthen cyber defenses.

Key responsibilities

• Carry out penetration testing across digital solutions, cloud applications and medical devices
• Identify and assess vulnerabilities and work with product teams to prioritize and fix them
• Provide security knowledge to product teams during design and development, supporting security by design
• Maintain the central repository of testing methods and tools
• Support the Incident Response team with technical analysis and forensics
• Run red team exercises and prepare security reports with risk assessments and recommendations
• Help integrate security-by-design principles and improve security processes, playbooks and tools
• Use AI-assisted security tools to expand the scope of vulnerability assessments

Required profile

• 2+ years of experience leading and running penetration testing on web apps, APIs, cloud environments and/or embedded devices, or expert offensive skills in a specialized security domain
• Bachelor's degree in Computer Science, Information Systems or a related field preferred
• Solid background in vulnerability assessment and penetration testing
• Experience with incident response and forensics is a plus
• Ability to explain complex vulnerabilities clearly to technical and non-technical stakeholders

Required skills

• Knowledge of common attack vectors, OWASP Top 10 and SDLC
• Automation of security controls (shell scripting, Python)
• Relevant certifications such as OSCP, CEH, SANS GIAC, CISSP, CISM or ISO27001 Lead Auditor are highly valued
• Interest in AI technologies, including LLM vulnerabilities and offensive agentic AI