• Perform medical device vulnerability scans, fuzz testing, penetration testing, security code reviews, and reverse engineering. Carrying out IOT penetration tests, application (mobile, MIoT and PC platform), network, systems, and infrastructure penetration tests and performing various aspects of vulnerability assessments / penetration tests across a wide variety of platforms and technologies in medical industry. Perform targeted testing activities to identify weaknesses and methods in which to exploit them.
• Review threat models and perform security risk assessments of medical products
• Helping evolve the knowledge of adversarial TTPs for medical devices and medical applications and apply that knowledge when evaluating and testing corporate resources. Adherence to the highest standards of safety, ethics, and professional conduct are critical requirements of this position.
• Supporting project initiatives to assess vulnerabilities in medical devices and medical/health software assets (via penetration tests, testing policies and procedures, etc.).
• Applying existing IT technical expertise to address cybersecurity related issues and challenges.
• Keeping up to date with tools, countermeasures, threats and technologies.
• Developing and refining tools, templates and methodologies.
• Interpreting vulnerabilities, identifying weaknesses, exploiting them and escalate access.

Required Qualifications

• Higher degree in Information Security, Computer Science, Computer/Software Engineering, Electrical Engineering, or relevant work experience
• Several years of professional experience in conducting IOT penetration testing, fuzz testing preferably in the medical sector (or other relevant sector).
• Security knowledge in the areas: Operation system security, mobile OS Security, embedded operation system security, communication protocols (Bluetooth/BLE/WIFI etc.), medical protocols (DICOM etc.), threat modeling, common security testing tools.
• Programming skills in Python, C/C++, C#, or similar for the purpose of code review and test automation
• Excellent technical expertise (in both breadth and depth), written communication skills, time management skills, and the ability to communicate effectively with numerous lines of business representatives.
• Experience with open source and commercial penetration testing security tools in an enterprise environment.
• Proficiency with Windows, Unix/Linux, and mobile platform operating systems.
• Comprehension of OWASP Top 10 (both web and (M)IoT), OSSTMM, PTES, NIST and able to understand and communicate findings to customers
• Must be willing to work flexible hours; they must also be able to travel, as required. Comfortable working in a fast-paced environment

Equal Opportunity Employer – Disability and Veteran

TÜV SÜD America, Inc. is an equal opportunity, affirmative action employer and considers qualified applicants for employment without regard to race, color, creed, religion, ancestry, marital status, genetics, national origin, sex, sexual orientation, gender identity and expression, age, physical or mental disability, veteran status and those laws, directives, and regulations of Federal, State, and Local governing bodies or agencies. We participate in the E-Verify Employment Verification Program.

For more information on applicable equal employment regulations, please refer to the following: Labor Law 2024