Senior Offensive Security Malware, Lead Analyst

Citi • Fort Lauderdale, FL

5d • Onsite

About The Position

About Citi: Citi, the leading global bank, has approximately 200 million customer accounts and does business in more than 160 countries and jurisdictions. Citi provides consumers, corporations, governments, and institutions with a broad range of financial products and services, including consumer banking and credit, corporate and investment banking, securities brokerage, transaction services, and wealth management. As a bank with a brain and a soul, Citi creates economic value that is systemically responsible and in our clients’ best interests. As a financial institution that touches every region of the world and every sector that shapes your daily life, our Operations & Technology teams are charged with a mission that rivals any large tech company. Our technology solutions are the foundations of everything we do from keeping the bank safe, managing global resources, and providing the technical tools our workers need to be successful to designing our digital architecture and ensuring our platforms provide a first-class customer experience. We reimagine client and partner experiences to deliver excellence through secure, reliable, and efficient services. Our commitment to diversity includes a workforce that represents the clients we serve from all walks of life, backgrounds, and origins. We foster an environment where the best people want to work. We value and demand respect for others, promote individuals based on merit, and ensure opportunities for personal development are widely available to all. Ideal candidates are innovators with well-rounded backgrounds who bring their authentic selves to work and complement our culture of delivering results with pride. If you are a problem solver who seeks passion in your work, come join us. We’ll enable growth and progress together. The Team: Are you interested in growing your career in Offensive Cyber Security? Our team of world class, talented individuals, who are passionate about security, put their skills to the test every day on a global scale. At Citi, you will be exposed to all sorts of technologies on an enterprise-scale, so hunger for knowledge and research is greatly appreciated and rewarded. Technology is constantly evolving, and Citi is evolving with it by adopting the latest application frameworks, migrating to cloud-based technologies, and implementing Artificial Intelligence in numerous workflows across the enterprise. Citi’s Offensive security team is at the forefront of testing and securing each of these solutions and you can make an impact on the next technology to be released. The Role: The Senior Offensive Security Malware Lead Analyst is a senior-level role centered on proactive and offensive cybersecurity that will lead the offensive security program for malware analysis and response. Additionally, the position will serve the broader application penetration testing domain which includes performing penetration testing engagements as well as overseeing external partner engagements to ensure that operational processes are adhered to. The primary goal is to secure Citi, its customers, and clients by proactively reviewing supply chain risks through the research, identification, validation, and exploitation of ingested malware within the software development lifecycle. The position involves leading efforts to secure the software supply chain by analyzing open-source packages and conducting advanced security assessments on a variety of web technologies. The ideal candidate will have deep expertise in malware analysis and application penetration testing. This is a hands-on technical role that requires a strategic mindset to drive remediation and enhance the organization's overall security posture in a dynamic, enterprise-scale environment.

Requirements

• Bachelor’s Degree with a minimum of 10 years' relevant experience, or a Master’s Degree with a minimum 5 years' experience in Malware analysis and/or application penetration testing
• Proven background in penetration testing and expertise in the risks associated with software supply chains and dependency trees.
• Hands-on experience with security testing tools such as BurpSuite Proxy, Postman, AppScan, WebInspect, and similar technologies.
• Must have or be willing to obtain industry-accredited security certifications such as OSCP, OSWE, CISSP, GWAPT, GPEN, or other related credentials.
• Advanced analytical and problem-solving skills with a demonstrated ability to take ownership and follow up on issues.
• Proficient in interpreting and applying policies, standards, and procedures.
• Excellent written and verbal communication skills.
• Demonstrated ability to work effectively in a team environment and perform well under pressure.

Nice To Haves

• Experience leveraging Artificial Intelligence to enhance offensive security processes is highly desirable.

Responsibilities

• Lead the offensive security program for malware analysis and response, focusing on proactively securing the software development lifecycle.
• Perform manual and dynamic analysis on potential open-source malware within NPM, Python, and other package ecosystems to identify supply chain risks.
• Act as a subject matter expert in offensive information security, performing manual security assessments on web technologies, including APIs, JavaScript Frameworks, and Artificial Intelligence systems.
• Conduct and facilitate security reviews, penetration testing engagements, and table-top/red-team/scenario analysis exercises.
• Drive remediation efforts by outlining defense-in-depth strategies and providing strategic solutions to developers on effective security controls.
• Evaluate, recommend, and assist in the selection of new and emerging external products, applications, and technologies with a focus on their security implications.
• Work closely with internal Applications Development to enhance both architecture and application security.
• Identify opportunities for enhancements to security standards, tools, and processes, and contribute to the review of internal activities for potential improvement and automation.
• Define secure configurations for network, database, server, and desktop technologies in alignment with security policies.
• Develop strong technical documentation and deliver clear presentations to articulate vulnerability assessment results to both technical and non-technical audiences.
• Assess risk during business decisions, ensuring compliance with applicable laws, rules, and regulations while safeguarding the firm's assets and reputation.

Benefits

• In addition to salary, Citi’s offerings may also include, for eligible employees, discretionary and formulaic incentive and retention awards.
• Citi offers competitive employee benefits, including: medical, dental & vision coverage; 401(k); life, accident, and disability insurance; and wellness programs.
• Citi also offers paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays.
• For additional information regarding Citi employee benefits, please visit citibenefits.com.
• Available offerings may vary by jurisdiction, job level, and date of hire.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level