Senior Software Engineer Technical Remediation & Enablement

Citi • New York, NY

6d • $142,320 - $213,480

About The Position

The Vice President (VP) / Senior Software Engineer – Technical Remediation & Enablement Lead is a hands-on, code-level technical specialist responsible for directly remediating software vulnerabilities across enterprise application teams. This individual contributor and team-level technical lead works with application developers and contractor engineers to fix static code vulnerabilities, patch vulnerable software dependencies, containerize workloads, and streamline local build and release pipelines to enable same-day vulnerability hotfixes and deployments.

The role combines active software engineering—including writing and refactoring code and debugging pipelines—with technical enablement. The engineer guides development squads in adopting internal security and build tools, resolving dependency conflicts, and packaging applications into modern containers for rapid, low-risk production releases. The position also involves validating remediation plans, reviewing contractor pull requests, piloting developer tools, and providing feedback to platform and tooling teams.

The job posting also describes the Applications Development Technology Lead Analyst role as a senior-level position responsible for establishing and implementing application systems and programs in coordination with the Technology team, leading application systems analysis and programming activities, and advising or coaching developers and analysts.

Requirements

• Bachelor’s degree in Computer Science, Software Engineering, Information Systems, or a related technical field; equivalent experience is also referenced in the general education description.
• 4–7 years of hands-on software development and engineering experience delivering enterprise web applications, microservices, or distributed backend systems.
• Proven experience directly fixing SAST vulnerabilities and managing third-party dependency or package upgrades in production environments.
• Hands-on experience containerizing applications and working with Docker and container orchestration platforms such as Kubernetes or OpenShift.
• Strong hands-on development proficiency in one or two enterprise languages, such as Java, Python, Go, C#/.NET, or TypeScript/Node.js.
• Ability to analyze and remediate findings from SAST tools such as SonarQube, Checkmarx, Veracode, or Fortify.
• Practical experience with dependency resolution and build tools such as Maven, Gradle, npm/yarn, NuGet, pip/Poetry, or Go modules, and SCA tools such as Snyk, Black Duck, or JFrog Xray.
• Hands-on experience creating production-grade Dockerfiles, managing multi-stage builds, patching container base images, and deploying to Kubernetes or OpenShift.
• Proficiency with Git, branching strategies such as Gitflow or trunk-based development, and pipeline configurations such as Jenkins, GitHub Actions, Tekton, GitLab CI, or Harness.
• Clear written and verbal communication, including the ability to explain security fixes in PR comments, documentation, and pairing sessions.
• Ability to work directly and empathetically with developers, troubleshoot collaboratively, and offer practical solutions.
• Ability to find safe workarounds or refactor code when library upgrades cause breaking API changes.
• The general qualifications section also lists 6–10 years of relevant Apps Development or systems analysis experience, extensive systems analysis and application programming experience, successful project management and implementation experience, subject matter expertise in at least one Applications Development area, ability to adjust priorities quickly, leadership and project management skills, and clear and concise written and verbal communication.

Nice To Haves

• Master’s degree preferred.

Responsibilities

• Write, refactor, and review application code to remediate static code analysis (SAST) findings, including injection vulnerabilities, cross-site scripting, insecure deserialization, improper error handling, and weak cryptography.
• Resolve third-party library and framework upgrades for SCA/CVE remediation, including transitive dependency conflicts, breaking API changes, and version incompatibilities across supported technology stacks.
• Implement targeted automated unit, integration, and regression tests to verify fixes and patched libraries without introducing functional regressions.
• Write and optimize Dockerfiles, container manifests, and base image configurations for Docker, OCI, Kubernetes, and OpenShift.
• Help application squads containerize legacy services, establish minimal base images, and automate base-image rebuild triggers for same-day OS and runtime patching.
• Configure and fine-tune CI/CD build scripts and release pipelines to shorten deployment cycles and eliminate manual steps for emergency hotfixes.
• Review application teams’ proposed remediation plans at code level and verify that version upgrades or logic refactoring address vulnerability root causes.
• Identify technical prerequisites for successful patching and release, such as test coverage gaps, build-tool upgrades, or compiler/runtime updates.
• Review contractor pull requests for code quality, security correctness, test coverage, and enterprise architectural standards.
• Guide contractor engineers, support their technical onboarding, and facilitate repository access.
• Pilot, adopt, and demonstrate internal developer tools, IDE security plugins, automated PR bots, and local scanning utilities within engineering squads.
• Troubleshoot false positives, scanner configuration errors, and build pipeline failures; provide actionable feedback to internal platform and tooling teams.
• Partner with management teams to integrate functions, identify system enhancements, deploy products, and improve processes.
• Resolve high-impact problems and projects by evaluating complex business processes, system processes, and industry standards.
• Provide application programming expertise and ensure application design adheres to the overall architecture blueprint.
• Develop standards for coding, testing, debugging, and implementation using advanced knowledge of system flows.
• Analyze issues, apply interpretive thinking, and develop innovative solutions; build knowledge of how business areas, architecture, and infrastructure integrate to meet business goals.
• Advise or coach mid-level developers and analysts and allocate work as necessary.
• Assess risk in business decisions, safeguard the firm, clients, and assets, comply with laws, rules, regulations, and policy, apply sound ethical judgment, and transparently escalate, manage, and report control issues.

Benefits

• Medical, dental, and vision coverage
• 401(k)
• Life, accident, and disability insurance
• Wellness programs
• Paid time off, including planned vacation time and unplanned sick leave
• Paid holidays
• Discretionary and formulaic incentive and retention awards may be available to eligible employees

What This Job Offers

• Job Type: Full-time
• Career Level: Senior