Senior Penetration Tester: Whitebox Security & Code Review

Citi; Singapore; On-site; SGD 150,000 - 210,000; Full time

Job summary

Citi in Singapore seeks a highly skilled penetration tester focused on vulnerability research, third‑party component analysis, and advanced whitebox testing, including source code review. You will identify complex security weaknesses across web, mobile, API platforms, develop PoC exploits, and provide actionable remediation guidance to development teams.

Strong communication to technical and non‑technical audiences is essential.

Qualifications

• 6+ years in penetration testing with whitebox focus.
• Proficient in at least one major language (Java/C#/Python).
• Experience with SAST/DAST and source code review.
• Ability to communicate security issues to diverse audiences.

Responsibilities

• Conduct vulnerability research and develop PoC exploits.
• Perform whitebox testing using source code and design docs.
• Review source code for security flaws across languages.
• Analyze third‑party libraries for CVEs and risk.
• Deliver remediation guidance and detailed reports.
• Stay current on threats and industry best practices.

Skills

Penetration testing

Whitebox testing

Source code review

Vulnerability research

Programming (Java/C#/Python)

OWASP Top 10

SAST/DAST tooling

Education

Bachelor’s in Computer Science

Master’s in Information Security

OSCE

GPEN

GXPN

Tools

Burp Suite

OWASP ZAP

Fortify

Checkmarx

Veracode

SonarQube

Job description

Citi in Singapore seeks a highly skilled penetration tester focused on vulnerability research, third‑party component analysis, and advanced whitebox testing, including source code review. You will identify complex security weaknesses across web, mobile, API platforms, develop PoC exploits, and provide actionable remediation guidance to development teams.

Strong communication to technical and non‑technical audiences is essential.