Senior Penetration Tester & Security Lead (Onsite)

Citi; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Citi is seeking a highly skilled penetration tester with a focus on vulnerability research, whitebox testing, and source code review to strengthen security across applications and infrastructure.

The role involves manual testing of Web, Mobile, Thick Client, and API assets, developing PoCs, evaluating third-party components, and delivering actionable remediation guidance. On-site, full-time in a fast-paced security team.

Qualifications

• 6+ years in pen testing or app security.
• Experience with whitebox testing and source code review.
• Proficiency in Java, C#, or Python.
• Understanding OWASP Top 10 and API security.

Responsibilities

• Conduct in-depth vulnerability research and develop proof-of-concept exploits.
• Perform comprehensive whitebox penetration tests using code and design docs.
• Review source code across Java, C#, Python, and JavaScript for security flaws.
• Evaluate third-party libraries and open-source components for vulnerabilities.
• Provide remediation guidance to development teams for secure coding and configuration.
• Develop and contribute to security testing tooling and automation.
• Prepare detailed reports outlining risks and mitigations for technical and non-technical audiences.

Skills

Penetration testing

Whitebox testing

Source code review

Vulnerability research

Programming languages

Communication skills

Education

Bachelor's or Master's degree in CS/InfoSec

Tools

SAST tools

DAST tools

Static analysis tools

Job description

Citi is seeking a highly skilled penetration tester with a focus on vulnerability research, whitebox testing, and source code review to strengthen security across applications and infrastructure.

The role involves manual testing of Web, Mobile, Thick Client, and API assets, developing PoCs, evaluating third-party components, and delivering actionable remediation guidance. On-site, full-time in a fast-paced security team.