2 days ago
Base Salary
$156k - $234k/yr
Responsibilities
- Design, build, and operate scalable batch and streaming pipelines that ingest, normalize, and enrich threat and exposure signals.
- Develop API integrations connecting security tools, data lakes, correlation engines, and downstream analyst or dashboard systems.
- Architect data models and correlation logic linking vulnerabilities, threats, assets, business context, and adversary behavior for risk prioritization.
- Own the long-term architecture of schemas, storage layers, streaming infrastructure, and the authoritative enterprise risk data substrate.
- Integrate adversary emulation, control validation, simulation, and defensive coverage results into exposure and risk models.
- Operate production pipelines and integrations with responsibility for uptime, performance, scalability, monitoring, alerting, self-healing, and data quality.
- Establish common taxonomies and data standards across heterogeneous security platforms and automate onboarding of new tools.
- Partner with security operations, threat intelligence, detection engineering, red/purple teams, data science, and platform architecture teams.
- Ensure sensitive threat and exposure data handling, storage, and access meet security, privacy, and regulatory requirements.
- Maintain architecture diagrams, runbooks, integration documentation, and knowledge-transfer materials.
Requirements
- Demonstrated ability to design end-to-end platform architectures spanning ingestion, correlation, validation, and delivery layers.
- Deep experience owning and operating complex, production-grade security data platforms.
- Hands-on experience building large-scale batch and streaming data pipelines using Kafka, Spark, Airflow, Flink, or equivalent tools.
- Strong API design and development experience, including authentication, rate limiting, versioning, REST, or GraphQL.
- Experience integrating vulnerability management, EDR/XDR, CSPM, SIEM, CMDB, threat intelligence, and simulation or emulation platforms.
- Strong data modeling and correlation-engine design experience for unified asset, vulnerability, threat, and adversary-risk views.
- Understanding of continuous exposure discovery, prioritization, validation, attacker techniques, defensive controls, and detection coverage.
- Proficiency in at least one of Python, Go, or Java for pipeline and integration development.
- Experience with cloud-native data infrastructure on AWS, Azure, or GCP, including data lakes, warehouses, and event-driven architectures.
- Understanding of vulnerability management, threat intelligence, exposure management, attack surface management, and risk-scoring frameworks such as CVSS and EPSS.
- Experience with relational, NoSQL, graph, and time-series databases for correlation and attack-path use cases.
- Strong software engineering fundamentals, including infrastructure-as-code, version control, testing, observability, and CI/CD practices.
- At least 10 years of experience leading a continuous exposure management program or initiative end-to-end is preferred.
- Familiarity with graph-based attack-path analysis, asset or risk graphs, adversary simulation or emulation frameworks, purple-team tooling, and AI/ML-driven security operations is preferred.
- Relevant GIAC, cloud security, or data certifications are preferred but not required in lieu of hands-on expertise.
- Bachelor’s or university degree, or equivalent experience, is required; a master’s degree is preferred.
Benefits
- Full-time position based in Irving, Texas.
- Base salary range of $156,160.00 to $234,240.00, excluding potential incentive and retention awards.
- Medical, dental, and vision coverage; 401(k); life, accident, and disability insurance; and wellness programs.
- Paid vacation, sick leave, and holidays, with offerings varying by jurisdiction, job level, and hire date.
Tech Stack
Categories
Data EngineeringSecurity
About Citi
Citi is a public financial-services company offering consumer and institutional banking, credit cards, wealth management, treasury and trade solutions, and capital-markets services. It serves individuals, corporations, financial institutions, and governments in more than 160 countries and jurisdictions, earning interest and fee income from lending, payments, trading, and advisory. Founded in 1812 and headquartered in New York, it trades on the NYSE under the ticker C.