Senior Penetration Tester - Whitebox Review

Citibank (Switzerland) AG; Singapore; On-site; Confidential; Full time

Job summary

Citi in Singapore seeks a Senior Penetration Tester to advance our offensive security program. You will perform deep vulnerability research, whitebox testing with access to design docs and source code, and assess third-party components across web, mobile, and APIs.

The role requires strong programming skills and experience with SAST/DAST tools, plus the ability to communicate findings clearly to engineering teams and leadership. Hybrid work model in Singapore is available.

Qualifications

• 6+ years of experience in penetration testing, ethical hacking, or application security with a focus on whitebox testing.
• Proven ability to identify novel vulnerabilities and develop reliable exploits.
• Strong programming skills in Java, C#, Python or similar, and API security best practices.
• Knowledge of OWASP Top 10 and secure coding practices, plus experience with SAST/DAST tools.

Responsibilities

• Conduct in-depth vulnerability research and develop proof-of-concept exploits.
• Perform comprehensive whitebox testing using source code and design documentation.
• Review source code across languages to identify security flaws.
• Assess third-party libraries and open-source components for risk.
• Provide remediation guidance to development teams with concrete fixes.
• Develop and leverage tooling for automated security testing and analysis.
• Prepare detailed risk reports for technical and non-technical audiences.
• Stay current on security threats, techniques, and industry best practices.

Skills

Penetration testing

Whitebox testing

Source code review

Programming (Java/C#/Python)

OWASP Top 10

SAST/DAST tools

Exploit development

Communication skills

Education

Bachelor's or Master's in CS/InfoSec

Tools

SAST

DAST

Source code review tooling

Job description

Citi in Singapore seeks a Senior Penetration Tester to advance our offensive security program. You will perform deep vulnerability research, whitebox testing with access to design docs and source code, and assess third-party components across web, mobile, and APIs.

The role requires strong programming skills and experience with SAST/DAST tools, plus the ability to communicate findings clearly to engineering teams and leadership. Hybrid work model in Singapore is available.