Application Security Penetration Engineer

Citi is seeking an Application Security Penetration Engineer to join its Offensive Security team. The role focuses on conducting deep-dive assessments and penetration testing across a range of technologies, with an emphasis on translating findings into clear risk guidance and remediation recommendations.

Role Responsibilities

• Perform manual vulnerability assessments and penetration testing across applications and/or infrastructure.
• Identify and validate potential security vulnerabilities across Citi applications, APIs, cloud-native services, and AI/ML architectures.
• Develop functional proof-of-concept code and exploit scenarios to demonstrate exploitability and tangible impact of security weaknesses.
• Research and use LLM-based security testing harnesses to uncover deeply embedded, non-obvious vulnerabilities.
• Find multi-step business logic abuse chains, cryptographic flaws, and complex privilege escalation paths that can bypass manual and traditional automated testing.
• Document vulnerabilities with reproduction steps, attack chains, and risk ratings in standardized assessment reports.
• Communicate assessment results to both technical and non-technical audiences.
• Explain vulnerabilities to application developers, system architects, and ML engineers, including root causes and business impact.
• Support remediation by outlining a defense-in-depth approach for business stakeholders.
• Recommend actionable mitigating controls, code-level remediation solutions, and AI safety guardrails to developers to close security gaps.
• Stay current with emerging offensive security techniques and participate in threat modeling and adversarial testing across traditional and AI-driven technology stacks.
• Support pentesting engagements for the firm’s critical, top-tier applications.
• Research ways to automate pentest activities, including the use of AI and LLM tooling, to improve vulnerability discovery.

Required Qualifications

• Minimum 1 to 3 years of hands-on experience in penetration testing, application security assessment, or software development, ideally in an enterprise environment.
• Hands-on experience with dynamic, proxy, and network testing tools such as Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, or OWASP ZAP.
• Hands-on experience with static analysis and software composition tools such as Checkmarx, BlackDuck, SonarQube, or Snyk.
• Exposure to AI security and adversarial testing tools including Garak, PyRIT, Counterfit, or the Adversarial Robustness Toolbox (ART) is advantageous.
• Strong foundation in enterprise programming and scripting languages including Python, Java, .NET/C#, C/C++, Ruby, and/or NodeJS.
• Familiarity with common web and application framework stacks such as Spring, AngularJS, React, Struts, ASP.NET Core, or AI orchestration libraries.
• Deep knowledge of application architectures and enterprise infrastructure, including databases, middleware, web servers, and cloud computing (GCP, AWS, Azure) supporting microservices and containerized workloads.
• Deep knowledge of industry security standards, including OWASP Top 10 and CWE/SANS Top 25.
• Working familiarity with emerging AI security standards, including OWASP Top 10 for LLMs, MITRE ATLAS, and NIST AI RMF.

Skills and Technologies

• Penetration testing and vulnerability assessment: Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, OWASP ZAP
• Static analysis and software composition: Checkmarx, BlackDuck, SonarQube, Snyk
• AI security and adversarial testing: Garak, PyRIT, Counterfit, Adversarial Robustness Toolbox (ART)
• Programming and scripting: Python, Java, .NET/C#, C/C++, Ruby, NodeJS
• Frameworks and ecosystems: Spring, AngularJS, React, Struts, ASP.NET Core
• Security and standards: OWASP Top 10, CWE/SANS Top 25, OWASP Top 10 for LLMs, MITRE ATLAS, NIST AI RMF
• Cloud platforms: GCP, AWS, Azure

Education and Certifications

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related discipline. Equivalent professional or hands-on experience may be considered in lieu of a degree.
• Must have or be willing to obtain industry-accredited security certifications such as OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+, or CySA+.

Benefits

• Medical, dental & vision coverage
• 401(k)
• Life, accident, and disability insurance
• Wellness programs
• Paid time off packages including planned time off (vacation), unplanned time off (sick leave), and paid holidays

Position Details

• Location: Irving, TX (onsite)
• Salary: USD 96,400 to 144,600 per year
• Time Type: Full time
• Job Family Group: Technology
• Job Family: Information Security
• Primary Location: Irving Texas, United States
• Anticipated posting close date: Oct 20, 2026