Senior Threat & Exposure Platform Engineer

Citigroup Inc.; Irving (TX); On-site; USD 156,000 - 234,000; Full time

Job summary

Citigroup Inc. in Irving, Texas, is seeking a highly experienced Threat & Exposure Management Platform Engineer to design, build, and operate the data platform that unifies threat, vulnerability, and exposure signals across the enterprise.

You will own the architecture connecting security tooling, threat intelligence, vulnerability data, and adversary validation results into a single, continuously updated substrate, enabling faster risk prioritization and automated response.

Qualifications

• Design end-to-end security data platforms with scalable pipelines and correlations.
• Experience integrating heterogeneous security tools and data sources.
• Strong architectural judgment for large-scale enterprise platforms.

Responsibilities

• Design, build, and operate scalable data pipelines and integrations.
• Develop and maintain API integrations to unify threat and exposure data.
• Architect and implement correlation logic linking vulnerabilities, threats, and assets.
• Own data substrate architecture, schemas, and storage layers.
• Ensure platform reliability with monitoring, uptime, and data quality.
• Collaborate with security operations, threat intel, and data science teams.

Skills

End-to-end platform architecture

Platform engineering leadership

Data pipeline design

API design (REST/GraphQL)

Security data platforms

Cloud data infrastructure

Programming (Python/Go/Java)

CI/CD & IaC

Data modeling & correlation

Cross-functional collaboration

Education

Bachelor’s degree or equivalent

Master’s degree preferred

Tools

Kafka

Spark

Airflow

Flink

REST/GraphQL APIs

AWS/Azure/GCP

Job description

Citigroup Inc. in Irving, Texas, is seeking a highly experienced Threat & Exposure Management Platform Engineer to design, build, and operate the data platform that unifies threat, vulnerability, and exposure signals across the enterprise.

You will own the architecture connecting security tooling, threat intelligence, vulnerability data, and adversary validation results into a single, continuously updated substrate, enabling faster risk prioritization and automated response.