Threat & Exposure Management Platform Engineer

Citi•Irving, TX

21h•$156,160 - $234,240

About The Position

Design, build, and operate the data platform and architecture that unifies threat, vulnerability, and exposure signals across the enterprise. This foundational platform engineering role supports the organization’s evolution toward AI-enabled security operations. The engineer owns the architecture connecting security tools, threat intelligence, vulnerability data, and adversary validation results into a continuously updated data substrate for risk prioritization and response. The role involves end-to-end ownership of complex, mission-critical systems, including data pipelines, integrations, correlation and data models, APIs, and the underlying storage and streaming architecture. The platform must support ongoing exposure discovery, prioritization, validation, remediation tracking, and analysis of defensive coverage, while meeting enterprise security, privacy, and regulatory requirements. The role works closely with security operations, threat intelligence, detection engineering, red/purple teams, and data science functions.

Requirements

Demonstrated ability to design end-to-end platform architectures across data ingestion, correlation, validation, and delivery, with sound judgment about scalability, extensibility, and maintainability.
Proven experience owning and operating complex, production-grade security data platforms end-to-end.
Hands-on experience building large-scale batch and streaming data pipelines using Kafka, Spark, Airflow, Flink, or equivalent tools.
Strong expertise in REST or GraphQL API design and development, including authentication, rate limiting, and versioning for high-throughput data.
Experience integrating heterogeneous security platforms, including vulnerability management, EDR/XDR, CSPM, SIEM, CMDB, threat intelligence, and simulation or emulation tools.
Strong background in data modeling and correlation engine design, including unifying asset, vulnerability, threat, and adversary-behavior data into risk views.
Practical understanding of operationalizing continuous exposure discovery, prioritization, and validation in a technical platform.
Familiarity with mapping known attacker techniques and behaviors to defensive controls and detection coverage.
Familiarity with simulation- or emulation-based control validation and integrating its outputs into broader risk models.
Proficiency in at least one major programming language: Python, Go, or Java.
Experience with cloud-native data infrastructure on AWS, Azure, or GCP, including data lakes, warehouses, and event-driven architectures.
Understanding of vulnerability management, threat intelligence, exposure management, attack surface management, and risk scoring frameworks such as CVSS and EPSS.
Experience with relational, NoSQL, graph, and time-series databases for correlation and attack-path use cases.
Strong software engineering fundamentals, including CI/CD, infrastructure as code, version control, testing, and observability.
Excellent cross-functional collaboration skills in a fast-paced, mission-critical environment.
Bachelor’s degree, university degree, or equivalent experience.

Nice To Haves

10+ years of experience leading a continuous exposure management program or initiative end-to-end, from architecture through operational rollout.
Familiarity with graph-based attack-path analysis or asset/risk graphs.
Hands-on experience with adversary simulation or emulation frameworks and purple-team tooling.
Experience supporting AI/ML-driven security operations or automation-first security initiatives.
Relevant certifications, such as GIAC, cloud security, or data certifications.
Master’s degree preferred.

Responsibilities

Design, build, and operate scalable, resilient batch and streaming pipelines to ingest, normalize, and enrich security, IT, cloud, threat, and exposure data.
Develop and maintain API integrations between security tools, data lakes, and correlation and analytics engines.
Architect correlation logic and data models linking vulnerabilities, threats, assets, adversary behavior, and business context for automated risk prioritization.
Build and evolve the data substrate, including schemas, storage layers, and streaming infrastructure, and own its long-term architectural direction.
Develop secure, documented APIs for downstream systems, dashboards, and analyst tools to consume unified threat and exposure data.
Build and operate platform capabilities for continuous exposure discovery, prioritization, validation, and remediation tracking.
Integrate adversary emulation, control validation, and simulation results into the correlation engine and risk prioritization process.
Design data models and pipelines to assess defensive coverage against real-world attack techniques and surface prioritized gaps.
Own production pipeline and integration uptime, performance, scalability, and data quality; implement monitoring, alerting, and self-healing mechanisms.
Establish common taxonomies and data standards to reconcile formats, severity scores, and asset identifiers across security tools.
Collaborate with security operations, threat intelligence, detection engineering, red/purple teams, and data science teams to meet operational and analytical needs.
Ensure data handling, storage, and access comply with enterprise security, privacy, and regulatory requirements.
Automate onboarding of data from new tools and platforms to reduce integration lead time.
Maintain architecture diagrams, runbooks, and integration documentation and support knowledge transfer.

Benefits

Medical coverage
Dental coverage
Vision coverage
401(k)
Life insurance
Accident insurance
Disability insurance
Wellness programs
Paid time off, including vacation and sick leave
Paid holidays
Discretionary and formulaic incentive and retention awards for eligible employees