Apply

Ready to go for it?

AI Apply speeds things up—apply directly if you prefer.

FREE ACCESS
5,000–10,000 jobs/day
Scoutfield Logo

See all jobs on Scoutfield

Search thousands of fresh jobs every day.

Discover
  • Fresh listings
  • Fast filters
  • No subscription required
Create a free account and start exploring right away.
Citi

Application Security Penetration Engineer

Citi

. Conduct manual vulnerability assessments and penetration testing across applications and/or infrastructure .

Posted 10/13/2026full-timeUnited StatesJunior💰 $96,400 - $144,600 per yearWebsite

Core Competencies

Role fit
Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in conducting vulnerability assessments and penetration testing across applications and infrastructure, with a strong foundation in programming and scripting languages. Proficient in utilizing security testing tools and frameworks while effectively communicating findings to both technical and non-technical stakeholders.

Highest-signal resume keywords
Penetration TestingVulnerability AssessmentPython ProgrammingBurp Suite ProxyOWASP Top 10

ATS Keywords

Tailor your resume
Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills
Penetration TestingVulnerability AssessmentApplication Security AssessmentDynamic Testing ToolsStatic Analysis ToolsEnterprise ProgrammingScripting LanguagesCloud ComputingApplication ArchitectureSecurity Standards
Soft Skills
CommunicationDocumentationCollaboration
Tools & Technologies
Burp Suite ProxyAppScanWebInspectNessusNMAPOWASP ZAPCheckmarxBlackDuckSonarQubeSnyk
Certifications & Qualifications
OSCPOSWEGWAPTGWEBGPENGXPNGMOBCISSPCEHCompTIA Security+
Industry Keywords
AI SecurityAdversarial TestingOWASP Top 10 for LLMsMITRE ATLASNIST AI RMFCWE/SANS Top 25MicroservicesContainerized WorkloadsDefense-in-DepthRisk Ratings

Tech Stack

Tools & technologies
AngularASP.NETAWSAzureCloudCyber SecurityGoogle Cloud PlatformJavaMicroservicesNode.jsPythonReactRubySpringC++.NET

About the role

Key responsibilities & impact
  • Conduct manual vulnerability assessments and penetration testing across applications and/or infrastructure
  • Identify and validate potential security vulnerabilities across applications, APIs, cloud-native services, and AI/ML architectures
  • Engineer functional proof-of-concept code and exploit scenarios to demonstrate exploitability and impact
  • Research and use LLM-based security testing harnesses to uncover deeply embedded vulnerabilities
  • Identify multi-step business logic abuse chains, cryptographic flaws, and complex privilege escalation paths
  • Document vulnerabilities, reproduction steps, attack chains, and risk ratings in standardized assessment reports
  • Report and articulate vulnerability assessment results to technical and non-technical audiences
  • Explain vulnerabilities, root causes, and business risks to application developers, system architects, and ML engineers
  • Drive remediation through defense-in-depth approaches and propose mitigating controls, code-level remediation solutions, and AI safety guardrails
  • Keep abreast of emerging offensive security techniques and participate in threat modeling and adversarial testing
  • Support pentesting engagements for critical, top-tier applications
  • Research ways to automate pentest activities using AI/LLM tooling

Requirements

What you’ll need
  • Minimum of 1-3 years of hands-on experience in penetration testing, application security assessment, or software development, ideally in an enterprise environment
  • Hands-on experience with dynamic/proxy/network testing tools such as Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, or OWASP ZAP
  • Hands-on experience with static analysis and software composition tools such as Checkmarx, BlackDuck, SonarQube, or Snyk
  • Exposure to AI security/adversarial testing tools such as Garak, PyRIT, Counterfit, or the Adversarial Robustness Toolbox (ART) is advantageous
  • Strong foundation in enterprise programming and scripting languages, including Python, Java, .NET/C#, C/C++, Ruby, and/or NodeJS
  • Familiarity with common web and application framework stacks, such as Spring, AngularJS, React, Struts, ASP.NET Core, or AI orchestration libraries
  • Deep knowledge of application architectures and enterprise infrastructure, including databases, middleware, web servers, and cloud computing (GCP, AWS, Azure) supporting microservices and containerized workloads
  • Deep knowledge of common industry security standards, including OWASP Top 10 and CWE/SANS Top 25
  • Working familiarity with emerging AI security standards, including OWASP Top 10 for LLMs, MITRE ATLAS, and NIST AI RMF
  • Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related discipline; equivalent professional or hands-on experience may be considered in lieu of a degree
  • Must have or be willing to obtain industry-accredited security certifications such as OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+, or CySA+

Benefits

Comp & perks
  • Discretionary and formulaic incentive and retention awards
  • Medical, dental & vision coverage
  • 401(k)
  • Life, accident, and disability insurance
  • Wellness programs
  • Paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays