7 hours ago
Pune, IndiaSenior
Responsibilities
- Write, refactor, and review application code to remediate SAST vulnerabilities and resolve dependency and package vulnerabilities.
- Upgrade third-party libraries and frameworks while managing transitive dependencies, breaking API changes, and version incompatibilities.
- Create unit, integration, and regression tests to validate security fixes and patched libraries.
- Containerize legacy applications and optimize Dockerfiles, container manifests, base images, and automated rebuild triggers.
- Configure and improve CI/CD build and release pipelines to support same-day emergency hotfix deployments.
- Review application remediation plans for technical validity, prerequisites, test coverage, and release readiness.
- Review contractor pull requests for code quality, security correctness, test coverage, and architectural standards.
- Guide application developers and contractors in adopting security scanners, IDE plugins, PR bots, and local developer tooling.
- Troubleshoot scanner false positives, configuration errors, dependency conflicts, and build pipeline failures.
- Provide actionable feedback to internal platform and tooling teams.
Requirements
- Bachelor’s degree in Computer Science, Software Engineering, Information Systems, or a related technical field, or equivalent experience.
- 10+ years of hands-on software development and engineering experience with enterprise web applications, microservices, or distributed backend systems.
- Demonstrated experience directly fixing SAST vulnerabilities and managing production third-party dependency and package upgrades.
- Hands-on experience with Docker, Kubernetes, and OpenShift, including production-grade Dockerfiles, multi-stage builds, and container base-image patching.
- Strong development proficiency in one or two of Java, Python, Go, C#/.NET, or TypeScript/Node.js.
- Experience with SAST tools such as SonarQube, Checkmarx, Veracode, or Fortify.
- Experience with Maven, Gradle, npm/yarn, NuGet, pip/Poetry, or Go modules, plus SCA tools such as Snyk, Black Duck, or JFrog Xray.
- Proficiency with Git and CI/CD pipeline tools such as Jenkins, GitHub Actions, Tekton, GitLab CI, or Harness.
- Master’s degree preferred.
- Ability to debug builds, resolve breaking dependency changes, communicate security fixes clearly, and work directly with development squads.
Tech Stack
C#DockerGitGitHub ActionsGitLab CI/CDGoGradleHarnessJavaJenkinsKubernetesMaven.NETNode.jsnpmOpenShiftPythonSonarQubeSpring BootTektonTypeScriptYarn
About Citi
Citi is a public financial-services company offering consumer and institutional banking, credit cards, wealth management, treasury and trade solutions, and capital-markets services. It serves individuals, corporations, financial institutions, and governments in more than 160 countries and jurisdictions, earning interest and fee income from lending, payments, trading, and advisory. Founded in 1812 and headquartered in New York, it trades on the NYSE under the ticker C.