Apply: Medical Device Penetration Tester

About you

Full name *

Email *

Phone

Location

LinkedIn, GitHub, or portfolio links

Resume (PDF, Word, or text, up to 10 MB)

Optional, but it helps. You can also paste a link above instead.

Cover letter file (PDF, Word, or text, up to 10 MB)

Optional. You still answer "Why this role fits you" below in a few sentences.

Video link

Paste a link to a 90 second video telling us why you are a fit. Unlisted YouTube, Loom, Google Drive, anything we can open. A phone camera is fine and we are not judging production quality. Optional, but it is the fastest way to stand out.

The work

Answer these in your own words. We are reading for how you think, not for length, and a generic answer is worse than a short one.

Why this role fits you *

Scenario one *

You find an unauthenticated service on a device, and the manufacturer says it is unreachable in clinical use. How do you decide whether that is a finding, and what evidence would you put in the report?

Scenario two *

You have three days left on an engagement and you have not found anything of consequence. What do you do with the time, and what does the report say at the end of it?

Write the finding *

You captured Bluetooth traffic from a patient monitor and the pairing exchange uses Just Works with no out-of-band confirmation. Write that finding the way it would appear in a report: what it is, why it matters for the patient, and what you would recommend. Under 200 words.

Specifics *

What tooling do you reach for first on an unfamiliar embedded target, and in what order? Then tell us about the last thing that had you stuck for more than a day and how it resolved.

Quick questions

Ten of them, a few minutes at most. Pick the best answer. We are not testing trivia, and getting a few wrong will not disqualify you.

1. On an embedded target, an exposed UART header on the board most often gives an attacker:

A console or bootloader interfaceRemote network access to the deviceEncrypted patient data onlyNothing useful without destroying the device

2. In medical device security risk assessment, exploitability is used in place of which ISO 14971 term?

Severity of harmHazardous situationProbability of occurrence of harmResidual risk

3. A CVSS base score on its own is not sufficient for medical device risk because it:

Is proprietary and cannot be publishedDoes not account for patient harm or clinical contextApplies only to web applicationsHas to be recalculated every year

4. Before touching a clinical device on a client site, the first thing you confirm is:

The wireless passwordThe device serial numberWhether the client has cyber insuranceWritten scope and authorization, including what must not be disrupted

5. Just Works BLE pairing is a concern mainly because it:

Uses an outdated radio bandProvides no authentication of the peer deviceDrains the batteryPrevents firmware updates

6. Finding secrets in extracted firmware most often indicates:

A packaging defectA false positive from the extraction toolHardcoded credentials or keys shared across the fleetAn encrypted partition

7. A report finding is most useful to a reviewer when it states:

The impact on the patient and the conditions required to exploit itThe tool name and version onlyA CVSS score with no contextThe number of hours spent

8. You discover a vulnerability that is out of the agreed scope. You:

Exploit it to prove the pointIgnore it entirelyPublish it after the engagementStop, document it, and raise it with the client before going further

9. Fuzzing an external interface is intended to reveal:

Coding style problemsWhether the SBOM is completeHow the device handles malformed or unexpected inputRegulatory gaps in the submission

10. The main reason a monitoring agent is usually not installed on a medical device is:

Agents cost too muchIt changes the validated configuration of a regulated productDevices have no processorAgents cannot read network traffic

Detail check *

Who does this role report to? The answer is on the job posting.

How you used AI on this application *

We use AI every day and we expect you to. Tell us honestly how you used it on this application: which tool, on which parts, and what you changed afterwards. "I did not use it" is a completely fine answer. What we cannot work with is a no when the writing says otherwise.

Something unique about you

Tell us something unique about you that will not show up anywhere else in this application. A hobby that got out of hand, something you build or collect or compete in, a language, a detour in your career, an unpopular opinion about our industry. Or, if you have an idea for how we should be working, tell us that instead. Optional, and there is no right answer.

How you work: our core values

Patient safety comes first here, ahead of deadlines, clients and convenience. After that we hold eight standards: role competence, client and team trust, ownership, judgment under ambiguity, growth and coachability, rigor and attention to detail, proactive risk anticipation, and innovation that never trades away what we protect. These questions are how we learn whether that is how you already work.

Give us real examples from your own work. Specific and honest beats polished.

Raising the inconvenient concern *

Standard: Patient safety comes first

Tell us about a time you raised a safety, quality or compliance concern when it was inconvenient: it cost a deadline, annoyed a client or a boss, or you were not sure it was big enough to mention. What was it, who did you tell, and what happened? If you have never done this, tell us about the time you should have and did not.

A gap that was nobody's job *

Standard: 3. Ownership

Describe a gap or problem that was clearly nobody's job, which you noticed and closed. What did you do, did you ask permission first, and what changed because you were involved?

Feedback that changed how you work *

Standard: 5. Growth and coachability

What is the most useful critical feedback you have received? Quote it as closely as you can, tell us how it felt at the time, and tell us specifically what you do differently now.

A call with incomplete information *

Standard: 4. Judgment under ambiguity

Tell us about a decision you made without all the information you wanted. What were the two or three ways to read the situation, which did you pick and why, and in hindsight was it the right call?

Situation 1

Two days before a client's FDA submission you notice something in your own earlier work that might be wrong. You are about 70% sure it is minor. What do you do?

Leave it. At 70% minor, raising it now only creates panic.Fix it quietly in the next version after the submission goes in.Tell your manager today, with what you found and how sure you are, and let them make the call with you.Email the client directly so they can decide.

Situation 2

You committed to a Friday deliverable. On Wednesday you realize it will be Monday. What do you do?

Work the weekend and say nothing unless it slips further.Tell the person now, give the new date and the reason, and offer what you can deliver by Friday.Send it Friday at whatever state it is in.Wait until Friday morning in case it comes together.

Situation 3

A number in a report you are about to send does not match the source by a small amount. Nobody would likely notice. What do you do?

Send it; the difference is immaterial.Round both so they appear to match.Hold it, trace the mismatch to its cause, fix it, and check whether the same error appears anywhere else.Add a footnote saying numbers may vary slightly.

Situation 4

A client asks you to drop a test step to hit their launch date. The step covers a real risk. What do you do?

Drop it; the client is paying and it is their call.Refuse and end the conversation.Name both sides out loud, then look for an option that protects the risk and still helps the date, such as a narrower test or a different order of work.Drop it but note it in the report so you are covered.

Situation 5

Your manager tells you a piece of your work missed the mark and you disagree with part of the feedback. What do you do?

Accept all of it to keep the peace.Ask questions until you understand their view, say where you still disagree and why, then act on what you agree with and follow up in a week.Explain why they are wrong.Say nothing and carry on as before.

Apply: Medical Device Penetration Tester

About you

The work

Quick questions

How you work: our core values

Work sample file