External Penetration Testing & Vendor Lead Vice President

PowerToFly; Singapore; Hybrid; SGD 100,000 - 120,000; Full time

Job summary

A leading financial institution in Singapore seeks a Senior Information Security Specialist to manage vendor relationships and oversee vulnerability disclosures. The ideal candidate will demonstrate at least 5 years of experience in Information Security, possess strong communication and analytical skills, and be proficient in Microsoft Office tools. This role requires overseeing penetration testing processes, analyzing vulnerabilities, and liaising with various stakeholders to enhance security measures. Familiarity with application security testing is a plus.

Qualifications

• Minimum of 5 years of relevant experience in Information Security or a relevant Technology role.
• Strong communication skills and ability to articulate processes.
• Advanced proficiency with Microsoft Office tools.

Responsibilities

• Serve as a liaison between Citi stakeholders and external vendors.
• Manage the end-to-end Vulnerability Disclosure Process.
• Analyze vulnerability trends to improve existing testing mechanisms.

Skills

Information Security

Communication

Analytical skills

Relationship management

Technical writing

Education

Bachelor’s degree or equivalent experience

Master’s degree preferred

Tools

Microsoft Office tools

Job description

This is a senior level professional position responsible for serving as a liaison between Citi Stakeholders and External Penetration Testing vendors to address testing challenges, drive vulnerability discussions with Citi Stakeholders, drive operational health of the penetration testing vendors along with their adherence to Citi procedures, analyze vulnerability trends to better improve the root cause model of existing testing mechanisms and maintain the overall security hygiene for the organization. This role will also require the candidate to manage the end-to-end Vulnerability Disclosure Process for Citi that would involve onboarding applications with vendors, triaging and driving lessons learned as part of the public disclosure and Private Bug Bounty program. The overall objective of this role is to ensure the execution of Information Security directives and activities is in alignment with Citi's data security policy.

Responsibilities:

• Be the central liaison between Citi stakeholders and the external penetration testing vendor, acting as a collaborator to ensure smooth execution of the end-to-end engagement.
• Manage the end-to-end process of Vulnerability Disclosure activities that involves onboarding applications, triaging, retesting and identifying lessons learned from the vulnerabilities reported through this channel.
• Knowledge of OWASP Top 10 and SANS top 25
• Perform Yearly Quality Checks on the vendors to ensure adherence to technical and process quality.
• Act as an application security subject matter expert to assist both Citi stakeholders and third-party vendors during vulnerability risk discussions.
• Focus and drive quality as it relates to the information submitted by the businesses who are requesting Penetration testing services and ensuring that the provided information is accurate and complete.
• Focus on maintaining a high level of operational oversight with all vendors and ongoing penetration testing activities in order to ensure that engagements are progressing forward with the right level of attention.
• Have strong communication skills in order to effectively communicate expectations and resolve challenges.
• Have strong technical writing and presentation skills to articulate the penetration testing process end-to-end to any audience.
• Contribute to the review of internal processes and activities and assist in identifying potential opportunities for improvement and automation.
• Reduce risk by analyzing the root cause of issues, their impact, and required corrective actions to existing processes.
• Appropriately assess risk when business decisions are made, demonstrating particular consideration for the firm's reputation and safeguarding Citibank, its clients and assets, by driving compliance with applicable laws, rules and regulations, adhering to Policy, applying sound ethical judgment regarding personal behavior, conduct and business practices, and escalating, managing and reporting control issues with transparency.

Qualifications:

• Minimum of 5 years of relevant experience in Information Security and/or relevant Technology role.
• Advanced proficiency with Microsoft Office tools and software
• Consistently demonstrates clear and concise written and verbal communication
• Proven influencing and relationship management skills
• Proven analytical skills

Plus:

• Familiarity or hands-on experience in application security testing
• Basic understanding of Web/ Mobile / API security and relevant testing tools
• Relevant Certifications is a plus not a requirement: GPEN, GWAPT, GMOB, GWEB

Education:

• Bachelor’s degree/University degree or equivalent experience
• Master’s degree preferred

This job description provides a high-level review of the types of work performed. Other job-related duties may be assigned as required.

#LI-Hybrid

Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law. If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi. View Citi’s EEO Policy Statement and the Know Your Rights poster.