3 days ago
London, United KingdomMid Level / Senior
Responsibilities
- Write, refactor, and review application code to remediate SAST findings such as injection, cross-site scripting, insecure deserialization, error-handling, and cryptography issues.
- Resolve third-party library and framework upgrades, including transitive dependency conflicts, breaking API changes, and version incompatibilities.
- Create automated unit, integration, and regression tests to validate remediation changes.
- Containerize legacy services and configure Dockerfiles, container manifests, base images, and automated base-image rebuild triggers.
- Configure and optimize CI/CD build and release pipelines for same-day emergency hotfix deployment.
- Review application remediation plans and verify that proposed code and library changes address vulnerability root causes.
- Identify testing, build-tool, compiler, and runtime prerequisites for successful patching and release.
- Review contractor pull requests for code quality, security correctness, test coverage, and architectural standards.
- Onboard contractor engineers and facilitate repository access.
- Pilot and support internal security tools, IDE plugins, automated pull-request bots, and local scanning utilities.
- Troubleshoot false positives, scanner configuration problems, dependency issues, and build pipeline failures.
- Provide actionable feedback to internal platform and tooling teams.
Requirements
- Bachelor’s degree in Computer Science, Software Engineering, Information Systems, or a related technical field.
- 4–7 years of hands-on software development and engineering experience delivering enterprise web applications, microservices, or distributed backend systems.
- Demonstrated experience fixing SAST vulnerabilities and managing production third-party dependency and package upgrades.
- Hands-on experience containerizing applications and using Docker, Kubernetes, or OpenShift.
- Strong development proficiency in one or two of Java with Spring Boot, Python, Go, C#/.NET, or TypeScript/Node.js.
- Experience with SAST tools such as SonarQube, Checkmarx, Veracode, or Fortify.
- Experience with dependency and build tools such as Maven, Gradle, npm, yarn, NuGet, pip, Poetry, or Go modules.
- Experience with SCA tools such as Snyk, Black Duck, or JFrog Xray.
- Experience creating production-grade Dockerfiles, using multi-stage builds, patching container base images, and deploying to Kubernetes or OpenShift.
- Proficiency with Git and pipeline tools such as Jenkins, GitHub Actions, Tekton, GitLab CI, or Harness.
- Ability to review code, troubleshoot complex dependency and build problems, communicate security fixes clearly, and guide developers through practical remediation.
Benefits
- Hybrid Citi London work model with up to two days working from home per week.
- Full-time employment with a competitively reviewed base salary and discretionary annual performance-related bonus.
- Holiday allowance starting at 27 days plus bank holidays, increasing with tenure.
- Private medical insurance packages, Employee Assistance Program, pension plan, and paid parental leave.
- Employee discounts and access to learning and development resources.
Tech Stack
C#DockerGitGitHub ActionsGitLab CI/CDGoGradleHarnessJavaJenkinsKubernetesMaven.NETNode.jsnpmOpenShiftPythonSonarQubeSpring BootTektonTypeScriptYarn
Categories
About Citi
Citi is a public financial-services company offering consumer and institutional banking, credit cards, wealth management, treasury and trade solutions, and capital-markets services. It serves individuals, corporations, financial institutions, and governments in more than 160 countries and jurisdictions, earning interest and fee income from lending, payments, trading, and advisory. Founded in 1812 and headquartered in New York, it trades on the NYSE under the ticker C.