Senior Penetration Tester: Whitebox Security Lead (Hybrid)

Citi; New York (NY); Hybrid; USD 142,000 - 189,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

Citi is seeking a highly skilled Senior Penetration Tester to lead advanced security testing across Citi's applications and infrastructure. You will perform deep vulnerability research, whitebox testing with access to source code and design docs, and provide remediation guidance to development teams.

The role requires expertise in programming languages such as Java, C#, Python, and JavaScript, familiarity with SAST/DAST tools, and a strong track record in OWASP Top 10 and API security.

Qualifications

• 6+ years in penetration testing or application security with emphasis on whitebox testing.
• Ability to identify novel vulnerabilities and develop reliable exploits.
• Strong programming skills and knowledge of secure coding practices.

Responsibilities

• Conduct in‑depth vulnerability research to discover novel attack vectors.
• Perform comprehensive whitebox penetration tests using source code and docs.
• Review source code across Java, C#, Python, and JavaScript for security flaws.
• Evaluate third‑party libraries and open‑source components for risks.
• Provide remediation guidance to development teams with actionable recommendations.
• Develop and adapt security testing tooling, including AI‑augmented analysis.
• Prepare detailed risk and mitigation reports for technical and non‑technical audiences.
• Stay current with the latest threats, techniques, and best practices.

Skills

Penetration testing

Vulnerability research

Source code review

Programming: Java/C#/Python

OWASP Top 10 & API security

SAST/DAST tools

Communication skills

Security certifications

Education

Bachelor's or Master’s in CS/InfoSec or related

Tools

SAST tools

DAST tools

Source code analysis tools

Job description

Citi is seeking a highly skilled Senior Penetration Tester to lead advanced security testing across Citi's applications and infrastructure. You will perform deep vulnerability research, whitebox testing with access to source code and design docs, and provide remediation guidance to development teams.

The role requires expertise in programming languages such as Java, C#, Python, and JavaScript, familiarity with SAST/DAST tools, and a strong track record in OWASP Top 10 and API security.