Senior Penetration Tester (Cyber Security)

About the role

Citi is looking for a highly skilled, experienced penetration tester focused on vulnerability research, third-party component analysis and advanced whitebox testing, including comprehensive source code review. The role sits in the Offensive Security & Vulnerability Management team, which runs deep-dive manual penetration tests on Citi's Web, Mobile, Thick Client and API applications, identifying, researching, validating and exploiting known and unknown application vulnerabilities. The successful candidate works closely with development teams to strengthen the security of applications and infrastructure.

Key responsibilities

• Research new attack vectors and zero-day vulnerabilities in enterprise applications, systems and third-party components, and build proof-of-concept exploits.
• Perform whitebox penetration tests using source code, design documentation and internal system knowledge.
• Conduct manual and automated source code reviews in languages such as Java, C# and Python to find vulnerabilities and misconfigurations.
• Analyse third-party libraries, frameworks and open-source components, flagging known CVEs and assessing risks.
• Give development teams clear, actionable remediation advice on secure coding, configuration and architecture.
• Help build and improve security testing tools, including AI-augmented static analysis and DAST solutions.
• Write detailed technical reports covering findings, risk levels and mitigations for technical and non-technical audiences.
• Stay up to date with emerging threats, vulnerabilities and best practices.

Required profile

• 6+ years of experience in penetration testing, ethical hacking or application security, with a strong focus on whitebox testing and/or source code review.
• Proven ability to research novel vulnerabilities and develop reliable exploits.
• Strong written and verbal communication skills, able to explain complex security issues to diverse audiences.
• Ability to work independently and in a team in a fast-paced environment.
• A relevant certification such as OSCE, GIAC GWAPT, GPEN or GXPN is preferred; an engineering and security background is ideal.
• Bachelor's or Master's degree in Computer Science, Information Security or a related field, or equivalent practical experience meeting most requirements.

Required skills

• Proficiency in at least one major programming language (Java, C#, Python).
• In-depth knowledge of OWASP Top 10 and API security best practices.
• Experience with SAST and DAST tools.