Application Security Penetration Engineer

Citi is hiring an Application Security Penetration Engineer for its Offensive Security team. The role conducts vulnerability assessments and penetration testing across applications, infrastructure, APIs, cloud-native services, and AI/ML systems, and communicates findings and remediation guidance to technical and business stakeholders.

What you'll do:

• Conduct manual vulnerability assessments and penetration testing across applications and/or infrastructure
• Identify and validate potential security vulnerabilities across Citi applications, APIs, cloud-native services, and AI/ML architectures
• Engineer functional proof-of-concept code and exploit scenarios to demonstrate the exploitability and tangible impact of identified security weaknesses
• Research and use LLM-based security testing harnesses to uncover deeply embedded, non-obvious vulnerabilities
• Identify multi-step business logic abuse chains, cryptographic flaws, and complex privilege escalation paths that evade manual and traditional automated testing
• Accurately document discovered vulnerabilities, reproduction steps, attack chains, and risk ratings in standardized assessment reports
• Report and articulate vulnerability assessment results to both technical and non-technical audiences
• Clearly articulate vulnerabilities to application developers, system architects, and ML engineers. Ensure they understand the root causes and true business risks
• Drive remediation by outlining a defense-in-depth approach to business stakeholders
• Propose actionable mitigating controls, code-level remediation solutions, and AI safety guardrails to developers to fully close security gaps
• Keep abreast of emerging offensive security techniques. Participate in threat modeling exercises and adversarial testing across both traditional and AI-driven technology stacks
• Support pentesting engagements for the firm's critical, top-tier applications

What they're looking for:

• Minimum of 1-3 years of hands-on experience in penetration testing, application security assessment, or software development ideally in an enterprise environment
• Hands-on experience with dynamic/proxy/network testing tools such as Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, or OWASP ZAP
• Hands-on experience with static analysis and software composition tools such as Checkmarx, BlackDuck, SonarQube, or Snyk
• Strong foundation in enterprise programming and scripting languages, including Python, Java, .NET/C#, C/C++, Ruby, and/or NodeJS
• Familiarity with common web and application framework stacks, such as Spring, AngularJS, React, Struts, ASP.NET Core, or AI orchestration libraries
• Deep knowledge of application architectures and enterprise infrastructure, including databases, middleware, web servers, and cloud computing (GCP, AWS, Azure) supporting microservices and containerized workloads
• Deep knowledge of common industry security standards, including OWASP Top 10 and CWE/SANS Top 25
• Working familiarity with emerging AI security standards, including OWASP Top 10 for LLMs, MITRE ATLAS, and NIST AI RMF
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related discipline. Equivalent professional or hands-on experience may be considered in lieu of a degree
• Must have or be willing to obtain industry-accredited security certifications such as OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+, or CySA+
• Exposure to AI security/adversarial testing tools such as Garak, PyRIT, Counterfit, or the Adversarial Robustness Toolbox (ART) is advantageous

Benefits:

• For eligible employees, discretionary and formulaic incentive and retention awards
• Medical, dental & vision coverage
• 401(k)
• Life, accident, and disability insurance
• Wellness programs
• Paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays. Available offerings may vary by jurisdiction, job level, and date of hire.