Senior Penetration Tester: Whitebox & AppSec Leader

Citigroup Inc.; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

Citigroup Inc. in Singapore seeks a highly experienced Senior Penetration Tester focused on vulnerability research, third-party component analysis, and advanced whitebox testing with source code review. You will identify, exploit, and guide remediation for complex security issues across Citi’s tech stack.

You will work with development teams to strengthen security, using SAST and DAST tools, and stay ahead of emerging threats in a fast-paced environment.

Qualifications

• 6+ years of experience in penetration testing with emphasis on whitebox testing and source code review.
• Proven vulnerability research including exploit development.
• Strong programming skills in Java, C#, Python.
• Deep knowledge of OWASP Top 10 and API security best practices.
• Experience with SAST and DAST tools.
• Excellent written and verbal communication; able to convey complex security issues to diverse audiences.
• Relevant certifications such as OSCE, GIAC GWAPT, GPEN, GXPN or similar.

Responsibilities

• Vulnerability Research & Exploitation: conduct in-depth research to discover new attack vectors and zero-day vulnerabilities; develop proof-of-concept exploits.
• Whitebox Penetration Testing: perform comprehensive whitebox tests using source code and internal system knowledge.
• Source Code Review: review code across languages to identify security flaws and misconfigurations.
• Third-Party Component Analysis: evaluate security of third-party libraries and open-source components.
• Remediation Guidance: provide actionable recommendations to developers for secure coding and architecture.
• Tooling & Automation: develop and use advanced security testing tools and automated analysis.
• Reporting & Communication: produce detailed reports for technical and non-technical audiences.
• Stay Current: continuously research latest threats and best practices.

Skills

Penetration testing

Whitebox testing

Source code review

Vulnerability research

Programming languages (Java C# Python)

OWASP Top 10 & API security

SAST/DAST tools

Communication

Team collaboration

Security certifications (OSCE GWAPT GP

Education

Bachelor’s or Master’s degree in Computer Science, Information Security, or related field

Tools

SAST tools

DAST tools

Job description

Citigroup Inc. in Singapore seeks a highly experienced Senior Penetration Tester focused on vulnerability research, third-party component analysis, and advanced whitebox testing with source code review. You will identify, exploit, and guide remediation for complex security issues across Citi’s tech stack.

You will work with development teams to strengthen security, using SAST and DAST tools, and stay ahead of emerging threats in a fast-paced environment.