Offensive Application Security Penetration Tester

Citi; Jacksonville (FL); Sur place; USD 96 000 - 145 000; Plein temps

Résumé du poste

Citi is seeking an Application Security Penetration Tester to join its Offensive Security team in Irving, TX. You will conduct deep-dive vulnerability assessments across web applications, mobile, APIs, microservices, and AI/LLM implementations, translating findings into risk guidance for developers and architects.

The role suits an experienced tester or software engineer transitioning to cybersecurity, with hands-on testing, PoC code, and a focus on AI security testing techniques to uncover

Qualifications

• 1-3 years in penetration testing, security assessment, or software development.
• Experience with dynamic/proxy/network testing tools (Burp Suite, AppScan, WebInspect, Nessus, NMAP, OWASP ZAP).
• Experience with static analysis and software composition tools (Checkmarx, BlackDuck, SonarQube, Snyk).
• Exposure to AI security/adversarial testing tools (Garak, PyRIT, Counterfit, ART) is advantageous.
• Strong foundation in enterprise programming languages (Python, Java, .NET/C#, C/C++, Ruby, NodeJS).
• Familiarity with web/app frameworks (Spring, AngularJS, React, Struts, ASP.NET Core, AI orchestration libs).
• Deep knowledge of architectures and cloud infra (databases, middleware, web servers, GCP/AWS/Azure).
• Familiarity with OWASP Top 10 and CWE/SANS Top 25.
• Working knowledge of AI security standards (OWASP Top 10 for LLMs, MITRE ATLAS, NIST AI RMF).

Responsabilités

• Conduct manual vulnerability assessments and penetration testing across applications and/or infrastructure.
• Identify and validate potential security vulnerabilities across Citi applications, APIs, cloud-native services, and AI/ML architectures.
• Engineer functional proof-of-concept code and exploit scenarios to demonstrate exploitability and impact.
• Research and use LLM-based security testing harnesses to uncover deeply embedded vulnerabilities.
• Identify multi-step business logic abuse chains and complex privilege escalation paths.
• Document vulnerabilities, steps to reproduce, attack chains, and risk ratings in assessment reports.
• Report results to technical and non-technical audiences.
• Articulate vulnerabilities to developers, system architects, and ML engineers with root-cause explanations.
• Drive remediation with defense-in-depth strategies and actionable mitigations.
• Stay current with offensive security techniques and AI-driven pentesting methods.

Connaissances

Burp Suite

AppScan

WebInspect

Nessus

NMAP

OWASP ZAP

Checkmarx

BlackDuck

SonarQube

Snyk

Garak

PyRIT

Counterfit

ART

Python

Java

.NET/C#

C/C++

Ruby

NodeJS

Spring

AngularJS

React

Struts

ASP.NET Core

AI orchestration

GCP

AWS

Azure

OWASP Top 10

CWE/SANS Top 25

LLM OWASP Top 10

MITRE ATLAS

NIST AI RMF

Formation

Bachelor’s in CS

Cybersecurity

Information Technology

Security certifications (OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+, CySA+)

Outils

Garak

PyRIT

Counterfit

ART

Description du poste

Citi is seeking an Application Security Penetration Tester to join its Offensive Security team in Irving, TX. You will conduct deep-dive vulnerability assessments across web applications, mobile, APIs, microservices, and AI/LLM implementations, translating findings into risk guidance for developers and architects.

The role suits an experienced tester or software engineer transitioning to cybersecurity, with hands-on testing, PoC code, and a focus on AI security testing techniques to uncover