2 days ago
Base Salary
$142k - $213k/yr
Responsibilities
- Write, refactor, and review application code to remediate SAST vulnerabilities such as injection, cross-site scripting, insecure deserialization, and weak cryptography.
- Resolve third-party dependency and framework upgrades, including transitive dependency conflicts, breaking API changes, and version incompatibilities.
- Create unit, integration, and regression tests to verify remediation changes and prevent functional regressions.
- Containerize legacy services and optimize Dockerfiles, container manifests, base images, and automated base-image rebuild triggers.
- Configure and improve CI/CD pipelines to reduce deployment time and support same-day emergency hotfix releases.
- Review application remediation plans and identify technical prerequisites such as test coverage, build tool, compiler, and runtime updates.
- Review contractor pull requests for code quality, security correctness, test coverage, and architectural standards.
- Pilot internal developer tools, IDE security plugins, automated pull-request bots, and local scanning utilities while troubleshooting scanner and build failures.
- Provide hands-on technical guidance, onboarding, and feedback to application developers, contractor engineers, and internal tooling teams.
Requirements
- Bachelor’s degree in Computer Science, Software Engineering, Information Systems, or a related technical field, or equivalent experience.
- 4–7 years of hands-on software development and engineering experience delivering enterprise web applications, microservices, or distributed backend systems.
- Proven experience fixing SAST vulnerabilities and managing third-party dependency or package upgrades in production.
- Hands-on experience containerizing applications and using Docker, Kubernetes, or OpenShift.
- Strong development proficiency in one or more of Java, Python, Go, C#/.NET, or TypeScript/Node.js.
- Experience with SAST tools such as SonarQube, Checkmarx, Veracode, or Fortify.
- Experience with dependency and build tools including Maven, Gradle, npm/yarn, NuGet, pip/Poetry, or Go modules, plus SCA tools such as Snyk, Black Duck, or JFrog Xray.
- Proficiency with Git and CI/CD pipeline tools such as Jenkins, GitHub Actions, Tekton, GitLab CI, or Harness.
- Demonstrated ability to troubleshoot dependency conflicts, breaking API changes, scanner issues, and build pipeline failures.
- Preferred qualification: a master’s degree.
- Strong communication, leadership, project management, prioritization, and technical mentoring skills.
Benefits
- Full-time position based in New York, New York.
- Base salary range of $142,320.00–$213,480.00, with potential discretionary and formulaic incentive and retention awards.
- Medical, dental, and vision coverage; 401(k); life, accident, and disability insurance; and wellness programs.
- Paid vacation, sick leave, and holidays.
Tech Stack
C#DockerGitGitHub ActionsGitLab CI/CDGoGradleHarnessJavaJenkinsKubernetesMaven.NETNode.jsnpmOpenShiftPythonSonarQubeSpring BootTektonTypeScriptYarn
About Citi
Citi is a public financial-services company offering consumer and institutional banking, credit cards, wealth management, treasury and trade solutions, and capital-markets services. It serves individuals, corporations, financial institutions, and governments in more than 160 countries and jurisdictions, earning interest and fee income from lending, payments, trading, and advisory. Founded in 1812 and headquartered in New York, it trades on the NYSE under the ticker C.