Senior VP, Penetration Testing & Security Research

Citigroup Inc.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Citi is seeking a Senior Penetration Tester to lead vulnerability research, whitebox testing, and source code reviews across enterprise applications and APIs. The role emphasizes proactive security, collaboration with development teams, and remediation guidance.

The ideal candidate will have extensive experience in vulnerability research, exposure to multiple languages, and familiarity with OWASP Top 10 and API security practices.

Qualifications

• 6+ years of experience in penetration testing, ethical hacking, or application security.
• Proven expertise in vulnerability research and exploit development.
• Strong programming skills in one or more languages (Java, C#, Python).

Responsibilities

• Conduct in-depth vulnerability research and develop POC exploits to demonstrate risk.
• Perform comprehensive whitebox testing using source code and design documentation.
• Review source code across languages to identify security flaws and misconfigurations.
• Evaluate third-party components for known vulnerabilities (CVEs).
• Provide remediation guidance to development teams for secure coding practices.
• Develop and improve security testing tooling and automation (SAST/DAST).
• Prepare detailed reports with risk levels and mitigations for technical and non-technical audiences.
• Stay updated on latest threats, techniques, and best practices.

Skills

Penetration testing

Vulnerability research

Source code review

Programming: Java, C#, Python

OWASP Top 10 & API security

SAST/DAST tools

Communication skills

Security certifications (OSCE, GWAPT,

Education

Bachelor’s or Master’s in CS / InfoSec

Tools

SAST tools

DAST tools

Source code review tooling

Job description

Citi is seeking a Senior Penetration Tester to lead vulnerability research, whitebox testing, and source code reviews across enterprise applications and APIs. The role emphasizes proactive security, collaboration with development teams, and remediation guidance.

The ideal candidate will have extensive experience in vulnerability research, exposure to multiple languages, and familiarity with OWASP Top 10 and API security practices.