Application Security Penetration Engineer

Citi • Tampa, FL

1d • $96,400 - $144,600 • Onsite

About The Position

Citi is seeking an Application Security Penetration Tester to join its Offensive Security team, conducting deep-dive vulnerability assessments across web applications, mobile, thick clients, APIs, microservices, and emerging Generative AI/LLM implementations. This role is well-suited for either an experienced penetration tester looking to deepen their offensive security career or a software developer/engineer seeking to transition into cybersecurity. The analyst will manually identify, research, validate, and safely exploit known and zero-day vulnerabilities, then translate technical findings into clear risk guidance for developers, architects, and ML engineers. A key focus of the role is researching and applying LLM-based security testing techniques to uncover complex, non-obvious vulnerabilities that evade traditional automated and manual testing. The team supports pentesting of the firm's most critical applications while actively researching AI/LLM-driven automation to enhance pentest effectiveness.

Requirements

• Minimum of 1-3 years of hands-on experience in penetration testing, application security assessment, or software development ideally in an enterprise environment.
• Hands-on experience with dynamic/proxy/network testing tools such as Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, or OWASP ZAP.
• Hands-on experience with static analysis and software composition tools such as Checkmarx, BlackDuck, SonarQube, or Snyk.
• Exposure to AI security/adversarial testing tools such as Garak, PyRIT, Counterfit, or the Adversarial Robustness Toolbox (ART) is advantageous.
• Strong foundation in enterprise programming and scripting languages, including Python, Java, .NET/C#, C/C++, Ruby, and/or NodeJS.
• Familiarity with common web and application framework stacks, such as Spring, AngularJS, React, Struts, ASP.NET Core, or AI orchestration libraries.
• Deep knowledge of application architectures and enterprise infrastructure, including databases, middleware, web servers, and cloud computing (GCP, AWS, Azure) supporting microservices and containerized workloads.
• Deep knowledge of common industry security standards, including OWASP Top 10 and CWE/SANS Top 25.
• Working familiarity with emerging AI security standards, including OWASP Top 10 for LLMs, MITRE ATLAS, and NIST AI RMF.

Nice To Haves

• Equivalent professional or hands-on experience may be considered in lieu of a degree.
• Must have or be willing to obtain industry-accredited security certifications such as OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+, or CySA+.

Responsibilities

• Conduct manual vulnerability assessments and penetration testing across applications and/or infrastructure.
• Identify and validate potential security vulnerabilities across Citi applications, APIs, cloud-native services, and AI/ML architectures.
• Engineer functional proof-of-concept code and exploit scenarios to demonstrate the exploitability and tangible impact of identified security weaknesses.
• Research and use LLM-based security testing harnesses to uncover deeply embedded, non-obvious vulnerabilities.
• Identify multi-step business logic abuse chains, cryptographic flaws, and complex privilege escalation paths that evade manual and traditional automated testing.
• Accurately document discovered vulnerabilities, reproduction steps, attack chains, and risk ratings in standardized assessment reports.
• Report and articulate vulnerability assessment results to both technical and non-technical audiences.
• Clearly articulate vulnerabilities to application developers, system architects, and ML engineers. Ensure they understand the root causes and true business risks.
• Drive remediation by outlining a defense-in-depth approach to business stakeholders.
• Propose actionable mitigating controls, code-level remediation solutions, and AI safety guardrails to developers to fully close security gaps.
• Keep abreast of emerging offensive security techniques. Participate in threat modeling exercises and adversarial testing across both traditional and AI-driven technology stacks.
• Support pentesting engagements for the firm's critical, top-tier applications.
• Research new ways to automate pentest activities, including the use of AI/LLM tooling, to identify vulnerabilities more effectively.

Benefits

• medical, dental & vision coverage
• 401(k)
• life, accident, and disability insurance
• wellness programs
• paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level