Medical Device Penetration Tester (Contract / One-Off Engagement)

Vallettasoftware - custom mobile/web software developer in the US and Europe. Our teams implement IT projects of varying complexity, including website and mobile app development, enterprise systems, and solutions based on artificial intelligence and machine learning (AI/ML).

We are proud to be named as one of the Top 10 Software Development Companies in Q2 2026 by 50Pros|Discover top agencies.

Our thorough approach to every project and deep understanding of Client's needs allow us to manage the outstanding quality.

About the Opportunity

We are looking for an experienced Penetration Tester to conduct a one-off comprehensive white-box penetration-testing engagement for a portfolio of network-connected physical medical/aesthetic devices with embedded software. This is a remote engagement with remote access to the devices.

Client: Global leader in medical/aesthetic devices.

Engagement type: One-off project (not full-time).

Location: Remote (devices will be accessed remotely).

Duration: Approximately 6–10 weeks (40–60 person-days).

Reports: Up to 5 technical reports + executive summary.

What You Will Do

• Conduct white-box penetration testing of network-connected medical/aesthetic devices with embedded software.
• Assess current-generation devices (MILEO, LISA) built on a shared Windows 10 IoT Enterprise platform.
• Assess legacy devices (UPA, Stellar) on an earlier Windows IoT platform.
• Review software architecture, design documentation, REST APIs, and system credentials.
• Identify vulnerabilities, assess risks, and provide remediation recommendations.
• Deliver comprehensive technical reports (platform-level + product-specific) and an executive summary.

What We Are Looking For

Must-Have

• ✅ Proven penetration-testing experience with network-connected medical devices or other embedded healthcare systems.
• ✅ Experience testing Windows-based embedded or IoT platforms (Windows IoT Enterprise, Windows Embedded).
• ✅ Experience with white-box penetration testing (source code review, architecture review).
• ✅ Experience with REST API security testing.
• ✅ Experience with operating system hardening (CIS benchmarks, STIG, etc.).
• ✅ Ability to work fully remotely and access devices via remote connection (VPN, etc.).
• ✅ Professional English — able to write technical reports and executive summaries.
• ✅ Experience writing reports for regulated industries (FDA, HIPAA, etc.).

Preferred Certifications

• 🎯 OSEP (Offensive Security Experienced Penetration Tester)
• 🎯 CRTP (Certified Red Team Professional)
• 🎯 OSCE3, GXPN, CREST CRT/CCT, or equivalent

Strongly Preferred Knowledge

• 📚 FDA Cybersecurity Guidance for Medical Devices
• 📚 AAMI TIR57 / AAMI TIR97
• 📚 IEC 81001-5-1
• 📚 ISO 14971 (cybersecurity risk management)
• 📚 NIST SP 800-115, OWASP Testing Guide, PTES

What You Will Deliver

• One consolidated report covering the shared software platform.
• Individual product-specific reports for assessed products (MILEO, LISA, UPA, Stellar).
• An executive summary suitable for management review.
• Technical details for every finding: severity/risk rating (CVSS), exploitation evidence, impact assessment, remediation recommendations, and re-test guidance.

Why This Role Is Unique

• You will be testing real medical devices used in clinical settings.
• You will work with embedded Windows IoT systems and REST APIs.
• You will contribute to regulatory compliance (FDA, IEC, ISO).
• This is a high-impact, high-visibility engagement with a global medical device leader.