Artificial Intelligence (AI) Offensive Security Analyst

Citi, the leading global bank, has approximately 200 million customer accounts and does business in more than 160 countries and jurisdictions. Citi provides consumers, corporations, governments, and institutions with a broad range of financial products and services, including consumer banking and credit, corporate and investment banking, securities brokerage, transaction services, and wealth management.

As a bank with a brain and a soul, Citi creates economic value that is systemically responsible and in our clients’ best interests. Our technology solutions are the foundations of everything we do from keeping the bank safe, managing global resources, and providing the technical tools our workers need to be successful to designing our digital architecture and ensuring our platforms provide a first-class customer experience.

The Chief Information Security Office (CISO) is home to deeply talented colleagues that work to ensure the safety of Citi's clients, our revenue, our employees and our proprietary data. We manage information security as one end-to-end program – one with a clear mandate and accountability.

Citi's Offensive Security and Vulnerability Management (OSVM) team is hiring practitioners who can run security assessments against AI systems and use AI-powered tools to make security testing faster and more effective. The AI Offensive Security Analyst is an operational role on a team that runs penetration tests, vulnerability assessments, and Red Team adversarial evaluations across Citi's application portfolio.

We're looking for someone to help build the tools from scratch and who knows how to get the most out of them, knows their limits, and can operate in an environment where the right approach isn't always obvious yet.

What You'll Work On:

• Testing AI applications and agents. GenAI applications, agentic systems, and LLM-backed products require testing that goes beyond standard web app methodology.
• Using AI to work better. AI-assisted testing changes what's possible in a pen testing engagement: broader coverage, faster reconnaissance, automated validation of common vulnerability classes.
• Embedding security into development. Working with development teams and security engineers to make sure AI application assessments happen at the right points in the build process.

What We're Looking For:

• Security Testing Experience: Practical experience running penetration tests or vulnerability assessments against web applications, APIs, or mobile applications.
• AI Literacy: Hands-on experience using LLM tools in a meaningful way, whether for security testing, security research, or your own workflows.
• General: Comfortable working on problems that don't have a playbook yet.

Education: Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience. Master’s degree preferred.

We offer a competitive base salary, 27 days annual leave (plus bank holidays), a discretional annual performance related bonus, Private Medical Care & Life Insurance, Employee Assistance Program, Pension Plan, Paid Parental Leave, and special discounts for employees, family, and friends.

This job description provides a high-level review of the types of work performed. Other job-related duties may be assigned as required.