Application Penetration Testing Manager, Senior Vice President

About the role

Citi is looking for an Application Penetration Testing Manager (Senior Vice President) for its Info Security Ops Group in Singapore. This senior management position provides strategic leadership, operational oversight and people management for application security testing services, ensuring high-quality Application Vulnerability Assessment and Management (AVA/AVM) services while protecting critical business applications from emerging cyber threats.

Key responsibilities

• Define and execute the long-term strategy and roadmap for application vulnerability management services, and lead the evolution of perimeter testing capabilities.
• Partner with senior cybersecurity leaders, technology organizations and business stakeholders to align security testing with enterprise risk management.
• Drive innovation, automation and process improvements to improve service effectiveness and efficiency.
• Oversee day-to-day AVA/AVM pentest operations, maintain service continuity and compliance with service level expectations, and set KPIs and quality metrics.
• Ensure timely identification, assessment, prioritization and remediation tracking of application vulnerabilities.
• Lead, mentor and develop a team of cybersecurity specialists, support workforce planning, succession planning and employee engagement, and give technical guidance to the team.
• Keep AVA/AVM services aligned with cybersecurity policies, standards and regulations, manage security, operational and compliance risks, and support internal and external audits.
• Act as the primary management representative for AVA/AVM services and present program performance and risk trends to senior leadership.

Required profile

• 10+ years of experience in application security, vulnerability assessment, vulnerability management, penetration testing or related cybersecurity fields.
• Demonstrated experience leading cybersecurity teams and managing large-scale security operations.
• Bachelor's degree or university degree, or equivalent experience.
• Relevant professional cybersecurity certification such as CISSP, CISM, GWAPT, GPEN or OSCP.

Required skills

• Strong understanding of application security testing methodologies, vulnerability management practices and secure software development principles.
• Experience building and running enterprise-scale application security programs.
• Knowledge of cloud security, DevSecOps practices and modern application architectures.
• Experience driving cybersecurity transformation and service modernization.