At a Glance
- Tasks: Drive software vulnerability remediation and enable teams to adopt secure coding practices.
- Company: Join Citi, a leading global bank with a focus on innovation and collaboration.
- Benefits: Enjoy competitive salary, generous holiday allowance, and hybrid working options.
- Other info: Dynamic work environment with excellent career growth and learning opportunities.
- Why this job: Make a real impact by enhancing security in cutting-edge applications.
- Qualifications: 4-7 years of software development experience and strong coding skills required.
The predicted salary is between 63000 - 77000 £ per year.
The Senior Software Engineer – Technical Remediation & Enablement Lead is a hands-on, code-level technical specialist responsible for driving the direct remediation of software vulnerabilities across enterprise application teams. This individual contributor / team-level technical lead works alongside application developers and contractor engineers to fix static code vulnerabilities (SAST), patch vulnerable software dependencies (SCA/third-party libraries), containerize workloads, and streamline local build/release pipelines to achieve same-day vulnerability hotfix and deployment capabilities.
This role combines active software engineering (writing/refactoring code and debugging pipelines) with technical enablement, guiding squad developers on how to adopt internal security and build tools, resolve tricky dependency conflicts, and package applications into modern containers for rapid, low-risk production releases.
What you’ll do
- Hands-On Code Remediation & Dependency Patching
- Write, refactor, and review application code to directly remediate static code analysis (SAST) findings (e.g., SQL/command injection, cross-site scripting, insecure deserialization, improper error handling, weak cryptography).
- Resolve complex third-party library and framework upgrades (SCA/CVE remediation), managing transitive dependency conflicts, breaking API changes, and version incompatibilities across Java, Python, Go, .NET, or JavaScript/TypeScript stacks.
- Implement targeted automated unit, integration, and regression tests to validate that code fixes and patched libraries do not introduce functional regressions.
- Containerization & Same-Day Release Enablement
- Work directly in application repositories to write and optimize Dockerfiles, container manifests, and base image configurations (Docker, OCI, Kubernetes/OpenShift).
- Assist application squads in containerizing non-containerized legacy services, establishing minimal base images and automated base-image rebuild triggers for same-day OS/runtime patching.
- Help configure and fine-tune CI/CD build scripts and release pipelines to compress deployment cycle times and eliminate manual deployment steps for emergency hotfixes.
- Application Plan Technical Validation
- Perform code-level reviews of proposed remediation plans from application teams, verifying whether proposed library version bumps or refactored logic effectively eliminate the root cause of the vulnerability.
- Identify technical prerequisites (e.g., test coverage gaps, build tool upgrades, compiler/runtime updates) needed before a team can successfully patch and release.
- Contractor Squad Pairing & PR Review
- Act as a peer reviewer and technical guide for external contractor engineers assigned to assist with remediation work.
- Review contractor-submitted pull requests (PRs) for code cleanliness, security correctness, test coverage, and enterprise architectural standards.
- Facilitate smooth technical onboarding and repository access for contractor developers.
- Internal Tooling Adoption & Developer Feedback
- Actively pilot, adopt, and demonstrate internal developer tools, IDE security plugins, automated PR bots (e.g., Dependabot/Renovate patterns), and local scanning utilities within engineering squads.
- Troubleshoot false positives, scanner configuration errors, and build pipeline failures; provide direct, actionable feedback to internal platform and tooling teams to improve developer experience.
What we’ll need from you
- Education & Experience Requirements
- Bachelor’s Degree in Computer Science, Software Engineering, Information Systems, or related technical field.
- 4–7 years of hands-on software development and engineering experience delivering enterprise web applications, microservices, or distributed backend systems.
- Proven track record of directly fixing static code vulnerabilities (SAST) and managing third-party dependency/package upgrades in production environments.
- Practical, hands-on experience containerizing applications and working with container orchestration platforms (Docker, Kubernetes, OpenShift).
- Technical Proficiencies
- Core Programming Languages: Strong, hands-on development proficiency in at least one or two primary enterprise languages: Java (Spring Boot), Python, Go, C#/.NET, or TypeScript/Node.js.
- Static Code Analysis (SAST): Ability to analyze and fix scanner findings from tools such as SonarQube, Checkmarx, Veracode, or Fortify.
- Dependency & Package Management: Practical experience with dependency resolution and build tools: Maven, Gradle, npm/yarn, NuGet, pip/Poetry, or Go modules, alongside SCA tools like Snyk, Black Duck, or JFrog Xray.
- Containers & Runtime: Hands-on experience creating production-grade Dockerfiles, managing multi-stage builds, patching container base images, and deploying to Kubernetes or OpenShift.
- CI/CD & Version Control: Proficient with Git, branching strategies (Gitflow/trunk-based), and pipeline configurations (e.g., Jenkins, GitHub Actions, Tekton, GitLab CI, Harness).
- Core Competencies
- Hands-On Craftsmanship: Loves writing code, debugging builds, untangling messy dependency trees, and seeing clean PRs merged to production.
- Developer-to-Developer Empathy: Speaks the language of squad engineers, troubleshoots shoulder-to-shoulder, and offers practical solutions rather than abstract advice.
- Pragmatic Problem Solver: Able to quickly find safe workarounds or code refactors when direct library upgrades introduce breaking API changes.
- Clear Communication: Explains the "why" and "how" of security fixes clearly in PR comments, documentation, and pairing sessions.
Key Performance Indicators (Success Metrics)
- Direct Remediation Output: Number of validated PRs merged and critical/high vulnerabilities (SAST & SCA) successfully resolved across assigned services.
- Same-Day Hotfix Readiness: Number of application components successfully containerized and equipped with automated verification pipelines capable of same-day hotfix releases.
- Turnaround Time for Technical Reviews: Fast, reliable review turnaround for application remediation plans and contractor pull requests.
- Build & Release Optimization: Measurable reduction in build and deployment friction for patched releases within supported application squads.
What we can offer you
We work hard to have a positive financial and social impact on the communities we serve. In turn, we put our employees first and provide the best-in-class benefits they need to be well, live well and save well. By joining Citi London, you will not only be part of a business casual workplace with a hybrid working model (up to 2 days working at home per week), but also receive a competitive base salary (which is annually reviewed), and enjoy a whole host of additional benefits such as:
- Generous holiday allowance starting at 27 days plus bank holidays; increasing with tenure
- A discretional annual performance related bonus
- Private medical insurance packages to suit your personal circumstances
- Employee Assistance Program
- Pension Plan
- Paid Parental Leave
- Special discounts for employees, family, and friends
- Access to an array of learning and development resources
Alongside these benefits Citi is committed to ensuring our workplace is where everyone feels comfortable coming to work as their whole self every day. We want the best talent around the world to be energized to join us, motivated to stay, and empowered to thrive. Sounds like Citi has everything you need? Then apply to discover the true extent of your capabilities.
Senior Software Engineer – Technical Remediation & Enablement employer: Citigroup
Citi is an exceptional employer, offering a dynamic work environment in the heart of London where innovation meets collaboration. As a Sales Director, you will benefit from extensive training and mentorship opportunities, fostering your professional growth while working alongside industry leaders in FX Sales. With a strong commitment to integrity and inclusivity, Citi provides a supportive culture that empowers employees to excel and drive meaningful results for clients.
StudySmarter Expert Advice🤫
We think this is how you could land Senior Software Engineer – Technical Remediation & Enablement
✨Join Local Tech Meetups
Get out there and mingle with fellow developers by joining local tech meetups. It’s a fantastic way to meet people who might be working at Citigroup or know someone who does. Plus, you can pick up some trendy tech skills and trends while you're at it!
✨Contribute to Open Source Projects
Show off your coding chops by jumping into open-source projects. Not only does this give you practical experience, but it also gets you noticed in the dev community. You'll create a killer portfolio that speaks volumes about your skills to Citigroup.
✨Tap into Online Developer Communities
Don’t underestimate the power of online developer communities like GitHub, Stack Overflow, and even Reddit. Participate in discussions, share your projects, and build your visibility. We can often find opportunities through these channels that can lead to a full-time gig at companies like Citigroup.
✨Explore Job Boards Specifically for Tech Roles
Keep your eyes peeled on job boards that focus on tech roles. Sites like TechCareers or Stack Overflow Jobs can often have listings for companies like Citigroup that might not show up on broader job sites. Make it a habit to check these regularly, and don’t hesitate to apply directly through our website!
We think you need these skills to ace Senior Software Engineer – Technical Remediation & Enablement
Some tips for your application 🫡
Show off your coding skills:When applying for a software engineering role, it's super important to showcase your coding skills. Make sure your CV includes your tech stack, any relevant programming languages you’re comfortable with, and examples of projects you've worked on. If you have a GitHub profile, link it up! We love to see code in action.
Tailor your portfolio:For a full-time role, we’d expect to see some solid examples of your work in your portfolio. Make sure to include at least two or three projects that highlight your problem-solving skills and your ability to work with different technologies. Focus on the projects that are most relevant to the position at Citigroup.
Craft a killer cover letter:Your cover letter is your chance to stand out—make it personal! Explain why you want to work at Citigroup and how your skills align with the role. Show us your passion for software development. We dig enthusiastic candidates who understand the value of collaboration and continuous learning!
Be clear and concise:When it comes to writing your CV and cover letter, clarity is key. Avoid jargon that could confuse us and stick to simple, direct language. Highlight your achievements with quantifiable results where possible, and keep everything easy to read. A well-organised application goes a long way!
How to prepare for a job interview at Citigroup
✨Brush Up on Your Coding Skills
For a full-time software engineering role, it's crucial that we stay sharp with our coding abilities. Expect technical questions that might involve solving problems on the spot or discussing algorithms. Practise on platforms like LeetCode or HackerRank to get comfortable with the types of questions that often come up.
✨Know Your Tools and Frameworks
Make sure we’re well-acquainted with the tools and technologies listed in the job description. Familiarise ourselves with any specific frameworks or programming languages mentioned. If Citigroup uses React or Node.js, for instance, be ready to discuss how we’ve used them in previous projects or coursework.
✨Showcase Your Projects
Bring along a portfolio that highlights our best work. This could be code samples, GitHub repositories, or any side projects we’ve built. Make sure we can talk through our thought process for each project, especially the challenges we faced and how we solved them—this shows our problem-solving skills in action.
✨Prepare for Behavioural Questions
While technical skills are key, full-time positions also require cultural fit. Be ready to discuss our previous experiences and how we handle teamwork, conflict, and deadlines. Brush up on the STAR method—Situation, Task, Action, Result—to clearly articulate our past experiences when discussing how we've contributed to a team.
