Senior Penetration Tester - Product Security & Privacy

About the role

Roche is looking for a Senior Penetration Tester to join its Product Security & Privacy Organization (PSPO), a global team that ensures the resilience and trustworthiness of its products and digital solutions. The role leads vulnerability assessments and penetration testing across physical and cloud-based products, working with engineering, product and architecture teams to strengthen cyber defenses while protecting patient safety.

Key responsibilities

• Design, prioritize and lead internal penetration testing across digital solutions, cloud applications and medical devices
• Identify and assess vulnerabilities and work with product teams to fix them throughout the product lifecycle
• Provide security guidance to product teams during design and development to ensure security by design
• Mentor and coach junior and mid-level pentesters
• Help maintain the central repository of testing methods and tools
• Support the Incident Response team with technical analysis and forensics, and run red team exercises
• Prepare security reports with risk assessments and recommendations, and integrate security-by-design principles across product lines
• Optimize processes, playbooks and tools, and explore offensive agentic AI to simulate autonomous threat actors

Required profile

• 5+ years of senior-level experience in offensive security across cloud, web, APIs and specialized devices
• Bachelor's degree in Computer Science, Information Systems or a related field preferred
• Experience with incident response and forensics is a plus
• Relevant certifications such as OSCP, CISSP, CISM, SANS GIAC or ISO27001 Lead Auditor are highly valued
• Strong understanding of AI/ML security risks and offensive agentic AI

Required skills

• Vulnerability assessment and penetration testing
• Knowledge of OWASP Top 10 and SDLC
• Automation of security controls (shell scripting, Python)
• Clear communication of vulnerabilities to technical and non-technical stakeholders