On-Site Application Security Penetration Tester

Citi; New York (NY); On-site; USD 96,000 - 145,000; Full time

Job summary

Citi is hiring an Application Security Penetration Tester to join its Offensive Security team. You will perform deep-dive vulnerability assessments across web apps, APIs, and AI/ML architectures, manually identifying and exploiting weaknesses, and translating findings into risk guidance.

The role emphasizes LLM-based security testing techniques and remediation guidance. The position suits an experienced tester or a software developer transitioning to cybersecurity, with opportunities to work on

Qualifications

• Minimum of 1-3 years of hands-on experience in penetration testing or software development
• Experience with dynamic/proxy testing tools such as Burp Suite, AppScan, WebInspect, Nessus, NMAP or OWASP ZAP
• Experience with static analysis and software composition tools such as Checkmarx, BlackDuck, SonarQube, or Snyk
• Exposure to AI security/adversarial testing tools is advantageous
• Strong foundation in enterprise programming languages including Python, Java, .NET/C#, C/C++, Ruby, and/or NodeJS
• Familiarity with Spring, AngularJS, React, Struts, ASP.NET Core, or AI orchestration libraries
• Knowledge of databases, middleware, web servers, cloud computing (GCP/AWS/Azure)
• Familiarity with OWASP Top 10 and CWE/SANS Top 25, and AI security standards like MITRE ATLAS and NIST AI RMF
• Bachelor’s degree or equivalent; security certifications preferred (OSCP/OSWE/GWAPT/GWEB/GPEN/GXPN etc.)

Responsibilities

• Conduct manual vulnerability assessments and penetration testing across applications and/or infrastructure
• Identify and validate security vulnerabilities across Citi applications, APIs, and cloud-native services
• Engineer proof-of-concept code and exploit scenarios to demonstrate exploitability
• Research and use LLM-based security testing harnesses to uncover advanced vulnerabilities
• Document vulnerabilities, reproduction steps, attack chains, and risk ratings clearly
• Communicate results to technical and non-technical audiences; drive remediation with defense-in-depth approaches
• Propose actionable remediation and AI safety guardrails to developers
• Stay updated on offensive security techniques and adversarial testing across tech stacks
• Support pentesting engagements for Citi’s critical applications
• Explore automation of pentest activities using AI/LLM tooling

Skills

Penetration testing

Burp Suite

AppScan

WebInspect

Nessus

NMAP

OWASP ZAP

Checkmarx

Snyk

Scripting languages

Python

Java

C/C++

NodeJS

GCP/AWS/Azure

AI security tools

Education

Bachelor's degree in Computer Science or related field

Tools

Garak

PyRIT

Counterfit

ART

OSCP/OSWE/GWAPT etc.

Job description

Citi is hiring an Application Security Penetration Tester to join its Offensive Security team. You will perform deep-dive vulnerability assessments across web apps, APIs, and AI/ML architectures, manually identifying and exploiting weaknesses, and translating findings into risk guidance.

The role emphasizes LLM-based security testing techniques and remediation guidance. The position suits an experienced tester or a software developer transitioning to cybersecurity, with opportunities to work on