Senior Security Engineer – Digital Assets Platform - VP

Citi; New York (NY); On-site; USD 142,000 - 213,000; Full time

Benefits offered by this job

Medical

Dental & Vision

401(k)

Life Insurance

Paid time off

Paid holidays

Job summary

Citi's Integrated Digital Assets Platform team in New York seeks a Senior Security Engineer (VP) to design and build security‑critical Java backend services, architect HSM integration, and implement MPC/TSS for distributed key management in institutional crypto workflows. The successful candidate will own cryptographic design patterns and drive security across the platform used by global clients.

The role requires deep cryptography knowledge, zero‑trust principles, threat modeling with

Qualifications

• 7–10 years of software/secure systems experience.
• Strong backend Java experience with security focus.
• Hands-on HSM integration via PKCS#11/JCE or vendor APIs.

Responsibilities

• Design, develop, and maintain security‑critical Java backend services.
• Own HSM integration, including API and key lifecycle management.
• Architect MPC/TSS protocols for distributed key management.
• Apply cryptographic best practices across the platform (AES-GCM, RSA, ECC).
• Define secure design patterns for distributed systems and zero‑trust architecture.
• Collaborate with Cybersecurity, Risk, Architecture teams on threat modeling and reviews.
• Champion security by design and integrate SAST/DAST into CI/CD pipelines.
• Engage with external vendors to inform Citi's technology roadmap.

Skills

Java backend

HSM integration

MPC protocols

Cryptography

Security design patterns

Threat modeling

CI/CD security tooling

Distributed systems

Education

Bachelor's degree in CS/CE/Cybersecurity

Master's or PhD in Cryptography/Security

Tools

PKCS#11

JCE/JCA

MPC libraries

Job description

Discover your future at Citi Working at Citi is far more than just a job. A career with us means joining a team of more than 230,000 dedicated people from around the globe. At Citi, you'll have the opportunity to grow your career, give back to your community and make a real impact.

About The Role

Working at Citi is far more than just a job. A career with us means joining a team of more than 230,000 dedicated people from around the globe. At Citi, you'll have the opportunity to grow your career, give back to your community and make a real impact.

Job Overview

Citi's Integrated Digital Assets Platform (CIDAP) is at the vanguard of institutional blockchain adoption — and security is its foundation. As digital assets move from innovation to regulated infrastructure, the cryptographic integrity of every transaction, wallet, and key lifecycle operation becomes mission-critical. We are building the security layer that the world's most sophisticated financial institution can trust.

We are seeking a Senior Security Engineer (VP) to join our New York-based Digital Assets Platform engineering team. This is a hands‑on, Java‑focused backend engineering role for a security‑minded engineer who understands both the craft of secure software development and the cryptographic primitives that underpin digital asset custody, signing, and key management.

You will sit inside the core engineering team — writing production code every day — while being the resident authority on cryptographic design patterns, HSM integration, MPC protocols, and security architecture. Your work will directly protect billions of dollars of digital asset infrastructure used by institutional clients worldwide.

Key Responsibilities

• Design, develop, and maintain security‑critical backend services in Java — including cryptographic libraries, key management APIs, signing workflows, and secure transaction pipelines — within Citi's Digital Assets Platform.
• Own the integration and operational lifecycle of Hardware Security Modules (HSMs) — including vendor evaluation, API integration (PKCS#11, JCE), key generation, rotation, and policy enforcement.
• Architect and implement Multi‑Party Computation (MPC) protocols and threshold signature schemes (TSS) for distributed key management and institutional‑grade wallet signing operations.
• Apply and enforce cryptographic best practices across the platform — including symmetric and asymmetric encryption (AES‑GCM, RSA, ECC), digital signatures (ECDSA, EdDSA), hashing, and key derivation (HKDF, PBKDF2).
• Define and implement secure design patterns for distributed systems — including zero‑trust architecture, secrets management, mutual TLS, certificate lifecycle management, and secure enclave usage.
• Collaborate with Citi's Cybersecurity, Risk, and Architecture teams to conduct threat modelling, security design reviews, and cryptographic risk assessments for new platform capabilities.
• Champion security‑by‑design across the engineering team — conducting code reviews with a security lens, embedding SAST/DAST tooling into CI/CD pipelines, and raising the security posture of every service shipped.
• Engage with external HSM vendors, MPC protocol libraries, and standards bodies to stay ahead of the cryptographic landscape and inform Citi's technology roadmap.
• Act as a technical escalation point for security incidents, vulnerability triage, and cryptographic design decisions across the Digital Assets Platform.

Qualifications Required

• 7–10 years of experience in software engineering with a significant focus on application security, cryptography, or secure systems design
• Strong, production‑level proficiency in backend Java — including experience building security‑critical, enterprise‑grade services
• Hands‑on experience integrating Hardware Security Modules (HSMs) via PKCS#11, JCE/JCA, or vendor‑specific APIs
• Practical understanding of Multi‑Party Computation (MPC) protocols, threshold signature schemes (TSS), or distributed key management architectures
• Deep knowledge of applied cryptography — symmetric/asymmetric encryption, digital signatures, key exchange protocols, certificate management (PKI/X.509), and secure hashing
• Familiarity with secure design patterns — zero‑trust, least‑privilege, secrets management, mTLS, and secure enclave technologies
• Experience with threat modelling frameworks (STRIDE, PASTA, or equivalent) and security design review processes
• Understanding of CI/CD security tooling — SAST, DAST, dependency scanning, secrets scanning
• Strong command of distributed systems fundamentals — microservices, API security (OAuth 2.0, JWT), and secure inter‑service communication patterns

Advantageous

• Experience in digital asset custody, blockchain key management, or institutional crypto infrastructure
• Familiarity with smart contract security patterns and on‑chain transaction signing workflows
• Knowledge of financial services regulatory frameworks relating to cryptographic controls (NIST SP 800‑57, FIPS 140‑2/3, PCI‑DSS)
• Exposure to MPC libraries such as MPC‑CMP, tss‑lib, or equivalent open‑source frameworks
• Background in penetration testing, red team exercises, or formal security certifications (CISSP, CSSP, CEH, OSCP)

Education

• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or a related technical discipline — required
• Master's or PhD in Cryptography, Information Security, or Computer Science — a strong advantage

Citi is an equal opportunity and affirmative action employer. Qualified applicants will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.

Job Family Group

Technology

Job Family

Applications Development

Time Type

Full time

Primary Location

New York New York United States

Primary Location Full Time Salary Range

$142,320.00 - $213,480.00

Benefits

• medical
• dental & vision coverage
• 401(k)
• life, accident, and disability insurance
• welfare programs
• paid time off packages
• planned time off (vacation)
• unplanned time off (sick leave)
• paid holidays

Automated Processing and AI

We use automated processing, including artificial intelligence, for our legitimate business interests (or our reasonable and appropriate business purposes) to identify and align the candidate's skills and abilities with a specific job opening. Additionally, if you so choose, or consent, we can match your skills and abilities to other suitable roles at Citi.

Importantly, all our hiring processes and decisions, including determining your suitability for a role, are conducted, checked, and decided by individuals. Our automated processing and AI do not involve relying on automatic or autonomous decision‑making. Please refer to any Jurisdictional Considerations, with specific provisions for your country (where relevant) for further details.

Illinois residents – AI Notice and Right

Anticipated Posting Close Date

Aug 18, 2026

If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.

View Citi’s EEO Policy Statement and the Know Your Rights poster.