VP, Senior Penetration Tester — Lead Security Research

Citi; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Citi's security team seeks a Senior Penetration Tester to join the Offensive Security & Vulnerability Management group. You will conduct deep vulnerability research, exploit verification, and whitebox testing across Citi's applications and infrastructure.

You will review source code, assess third-party components, and deliver remediation guidance to development teams. Strong communication skills and relevant certifications are essential for success.

Qualifications

• 6+ years of experience in penetration testing, ethical hacking, or application security, with a significant focus on whitebox testing and/or source code review.
• Proven expertise in vulnerability research, including the ability to identify novel vulnerabilities and develop reliable exploits.
• Strong proficiency in at least one major programming language (e.g., Java, C#, Python) and familiarity with others.
• In-depth understanding of common web application vulnerabilities (OWASP Top 10) and API security best practices.
• Experience with static application security testing (SAST) tools and dynamic application security testing (DAST) tools.
• Excellent written and verbal communication skills, with the ability to articulate complex security issues to diverse audiences.
• Ability to work independently and as part of a team in a fast-paced, dynamic environment.
• Relevant industry certifications such as OSCE, GIAC GWAPT, GPEN, GXPN, or similar.

Responsibilities

• Vulnerability Research & Exploitation: Conduct in-depth research to discover new attack vectors and zero-day vulnerabilities in enterprise applications, systems, and third-party components.
• Whitebox Penetration Testing: Perform comprehensive whitebox penetration tests, leveraging access to source code and internal knowledge.
• Source Code Review: Conduct manual and automated reviews across languages (Java, C#, Python, JavaScript).
• Third-Party Component Analysis: Evaluate security of libraries and open-source components for known vulnerabilities.
• Remediation Guidance: Provide clear, actionable remediation recommendations to development teams.
• Tooling & Automation: Develop and improve security testing tools, including static and dynamic analysis.
• Reporting & Communication: Prepare detailed technical reports with findings and mitigations.
• Stay Current: Research latest threats and industry best practices.

Skills

Penetration testing

Vulnerability research

Programming languages

OWASP Top 10

SAST/DAST tools

Communication skills

Independent / teamwork

Security certifications

Education

Bachelor's or Master's in Computer Science or Information Security

Job description

Citi's security team seeks a Senior Penetration Tester to join the Offensive Security & Vulnerability Management group. You will conduct deep vulnerability research, exploit verification, and whitebox testing across Citi's applications and infrastructure.

You will review source code, assess third-party components, and deliver remediation guidance to development teams. Strong communication skills and relevant certifications are essential for success.