Senior Offensive Security Penetration Tester - Crypto and Digital Assets

About the role

Citi's application penetration testing team tests and secures its own and third-party SaaS applications (web, mobile, thick client and APIs) using full end-to-end white-box and grey-box testing. The team covers technologies from artificial intelligence to digital assets and blockchain, and the role focuses on manually identifying, researching, validating and exploiting application security weaknesses and misconfigurations. The position is based in Singapore.

Key responsibilities

• Plan, scope and execute penetration tests against blockchain networks, smart contracts, DeFi protocols and digital asset custody systems.
• Perform manual and automated source code reviews of smart contracts in Solidity, Rust, Go or Vyper, looking for logic flaws, reentrancy, front-running, flash loan and integer overflow issues.
• Act as a subject matter expert in offensive security, assessing APIs, JavaScript frameworks, AI and distributed ledger technologies.
• Drive remediation by proposing a defense-in-depth approach to business stakeholders and preventive and detective controls to developers.
• Report vulnerability findings clearly to any audience and contribute to process reviews and automation opportunities.
• Research emerging attack vectors, zero-day exploits and novel vulnerabilities in Web3 and digital asset ecosystems.

Required profile

• Background in both software development and security, with hands-on experience in blockchain, digital assets and smart contracts.
• Strong understanding of cryptography: symmetric and asymmetric encryption, hashing and digital signatures.
• Experience building custom security scripts for offensive tooling and/or CI/CD security automation.
• Master's degree or PhD with 3+ years of professional or research experience, or a Bachelor's degree with 5+ years of relevant experience.
• Industry-accredited security certification such as BSCP, GWAPT, GPEN, OSCP, OSWE, CISSP or similar.

Required skills

• Smart contract analysis with Slither and Mythril
• Burp Suite Proxy and Postman
• Application and blockchain security testing tools