Software Engineer - Technical Remediation & Enablement

Citigroup Inc.; United States; Híbrido; USD 120.000 - 180.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Generous holiday allowance starting at

Discretional annual bonus

Private medical insurance

Pension Plan

Paid Parental Leave

Employee discounts

Learning and development resources

Descripción de la vacante

Citigroup Inc. is seeking engineers to remediate static code analysis findings, upgrade third-party libraries, and validate fixes across Java, Python, Go, .NET, and JavaScript/TypeScript stacks. The role emphasizes containerization, CI/CD improvements, and collaboration with external contractors.

You will implement automated tests, review PRs for security and quality, and help optimize release pipelines for faster, safer deployments. The position is based in Citi London with a hybrid work model.

Formación

• Directly fix static code vulnerabilities (SAST) in production systems.
• Containerize applications and manage container orchestration platforms (Docker/Kubernetes/OpenShift).
• Improve dependency upgrades and SCA remediation with build/test optimizations.

Responsabilidades

• Review remediation plans and ensure root-cause elimination of vulnerabilities.
• Coordinate with application teams on dependency upgrades and API changes.
• Review PRs for security correctness, test coverage, and adherence to standards.
• Onboard contractor engineers and manage repository access.

Conocimientos

SAST remediation

Code review

CI/CD pipelines

Security testing

Educación

Bachelor's Degree in Computer Science/Engineering

Herramientas

Docker

Kubernetes

OpenShift

Jenkins

GitHub Actions

Descripción del empleo

Responsibilities

• Write, refactor, and review application code to directly remediate static code analysis (SAST) findings (e.g., SQL/command injection, cross-site scripting, insecure deserialization, improper error handling, weak cryptography).
• Resolve complex third-party library and framework upgrades (SCA/CVE remediation), managing transitive dependency conflicts, breaking API changes, and version incompatibilities across Java, Python, Go, .NET, or JavaScript/TypeScript stacks.
• Implement targeted automated unit, integration, and regression tests to validate that code fixes and patched libraries do not introduce functional regressions.

Containerization & Same-Day Release Enablement

• Work directly in application repositories to write and optimize Dockerfiles, container manifests, and base image configurations (Docker, OCI, Kubernetes/OpenShift).
• Assist application squads in containerizing non-containerized legacy services, establishing minimal base images and automated base-image rebuild triggers for same-day OS/runtime patching.
• Help configure and fine-tune CI/CD build scripts and release pipelines to compress deployment cycle times and eliminate manual deployment steps for emergency hotfixes.

Application Plan Technical Validation

• Perform code-level reviews of proposed remediation plans from application teams, verifying whether proposed library version bumps or refactored logic effectively eliminate the root cause of the vulnerability.
• Identify technical prerequisites (e.g., test coverage gaps, build tool upgrades, compiler/runtime updates) needed before a team can successfully patch and release.

Contractor Squad Pairing & PR Review

• Act as a peer reviewer and technical guide for external contractor engineers assigned to assist with remediation work.
• Review contractor-submitted pull requests (PRs) for code cleanliness, security correctness, test coverage, and enterprise architectural standards.
• Facilitate smooth technical onboarding and repository access for contractor developers.

Internal Tooling Adoption & Developer Feedback

• Actively pilot, adopt, and demonstrate internal developer tools, IDE security plugins, automated PR bots (e.g., Dependabot/Renovate patterns), and local scanning utilities within engineering squads.
• Troubleshoot false positives, scanner configuration errors, and build pipeline failures; provide direct, actionable feedback to internal platform and tooling teams to improve developer experience., + Hands-On Craftsmanship: Loves writing code, debugging builds, untangling messy dependency trees, and seeing clean PRs merged to production.
• + Developer-to-Developer Empathy: Speaks the language of squad engineers, troubleshoots shoulder-to-shoulder, and offers practical solutions rather than abstract advice. + Pragmatic Problem Solver: Able to quickly find safe workarounds or code refactors when direct library upgrades introduce breaking API changes. + Clear Communication: Explains the "why" and "how" of security fixes clearly in PR comments, documentation, and pairing sessions.

Key Performance Indicators (Success Metrics)

• + Direct Remediation Output: Number of validated PRs merged and critical/high vulnerabilities (SAST & SCA) successfully resolved across assigned services.
• + Same-Day Hotfix Readiness: Number of application components successfully containerized and equipped with automated verification pipelines capable of same-day hotfix releases.
• + Turnaround Time for Technical Reviews: Fast, reliable review turnaround for application remediation plans and contractor pull requests.
• + Build & Release Optimization: Measurable reduction in build and deployment friction for patched releases within supported application squads.

Qualifications

• + Bachelor's Degree in Computer Science, Software Engineering, Information Systems, or related technical field.
• + 4-7 years of hands-on software development and engineering experience delivering enterprise web applications, microservices, or distributed backend systems.
• + Proven track record of directly fixing static code vulnerabilities (SAST) and managing third-party dependency/package upgrades in production environments.
• + Practical, hands-on experience containerizing applications and working with container orchestration platforms (Docker, Kubernetes, OpenShift).

Technical Proficiencies

• + Core Programming Languages: Strong, hands-on development proficiency in at least one or two primary enterprise languages: Java (Spring Boot), Python, Go, C#/.NET, or TypeScript/Node.js.
• + Static Code Analysis (SAST): Ability to analyze and fix scanner findings from tools such as SonarQube, Checkmarx, Veracode, or Fortify.
• + Dependency & Package Management: Practical experience with dependency resolution and build tools: Maven, Gradle, npm/yarn, NuGet, pip/Poetry, or Go modules, alongside SCA tools like Snyk, Black Duck, or JFrog Xray.
• + Containers & Runtime: Hands-on experience creating production-grade Dockerfiles, managing multi-stage builds, patching container base images, and deploying to Kubernetes or OpenShift.
• + CI/CD & Version Control: Proficient with Git, branching strategies (Gitflow/trunk-based), and pipeline configurations (e.g., Jenkins, GitHub Actions, Tekton, GitLab CI, Harness).

Working at Citi is far more than just a job. A career with us means joining a team of approximately 219,000 dedicated people from around the globe. At Citi, you'll have the opportunity to grow your career, give back to your community and make a real impact.

By joining Citi London, you will not only be part of a business casual workplace with a hybrid working model (up to 2 days working at home per week), but also receive a competitive base salary (which is annually reviewed), and enjoy a whole host of additional benefits such as:

• Generous holiday allowance starting at 27 days plus bank holidays; increasing with tenure
• A discretional annual performance related bonus
• Private medical insurance packages to suit your personal circumstances
• Employee Assistance Program
• Pension Plan
• Paid Parental Leave
• Special discounts for employees, family, and friends
• Access to an array of learning and development resources

Alongside these benefits Citi is committed to ensuring our workplace is where everyone feels comfortable coming to work as their whole self every day. We want the best talent around the world to be energized to join us, motivated to stay, and empowered to thrive.