Senior Penetration Tester - Whitebox Review

Citigroup Inc.; Singapore; Híbrido; SGD 130.000 - 180.000; Jornada completa

Descripción de la vacante

Citi in Singapore seeks a Senior Penetration Tester to advance our offensive security program. You will perform deep vulnerability research, whitebox testing with access to design docs and source code, and assess third-party components across web, mobile, and APIs.

The role requires strong programming skills and experience with SAST/DAST tools, plus the ability to communicate findings clearly to engineering teams and leadership. Hybrid work model in Singapore is available.

Formación

• 6+ years of experience in penetration testing, ethical hacking, or application security with a focus on whitebox testing.
• Proven ability to identify novel vulnerabilities and develop reliable exploits.
• Strong programming skills in Java, C#, Python or similar, and API security best practices.
• Knowledge of OWASP Top 10 and secure coding practices, plus experience with SAST/DAST tools.

Responsabilidades

• Conduct in-depth vulnerability research and develop proof-of-concept exploits.
• Perform comprehensive whitebox testing using source code and design documentation.
• Review source code across languages to identify security flaws.
• Assess third-party libraries and open-source components for risk.
• Provide remediation guidance to development teams with concrete fixes.
• Develop and leverage tooling for automated security testing and analysis.
• Prepare detailed risk reports for technical and non-technical audiences.
• Stay current on security threats, techniques, and industry best practices.

Conocimientos

Penetration testing

Whitebox testing

Source code review

Programming (Java/C#/Python)

OWASP Top 10

SAST/DAST tools

Exploit development

Communication skills

Educación

Bachelor's or Master's in CS/InfoSec

Herramientas

SAST

DAST

Source code review tooling

Descripción del empleo

Citi in Singapore seeks a Senior Penetration Tester to advance our offensive security program. You will perform deep vulnerability research, whitebox testing with access to design docs and source code, and assess third-party components across web, mobile, and APIs.

The role requires strong programming skills and experience with SAST/DAST tools, plus the ability to communicate findings clearly to engineering teams and leadership. Hybrid work model in Singapore is available.