Application Security Technical Lead, Citi

Citi

Location:
United Kingdom, London

Category:
IT - Software Development

Contract Type:
Employment contract

Salary:

Not provided

Save Job

Apply Position

Job Description:

The position is a cross-functional role responsible for various Application Security program initiatives, reporting directly to the Application Security Program Director. The role emphasizes engineering-led software security practices and navigating the evolving cybersecurity threat landscape.

Job Responsibility:

Establish and manage multiple security programs that support the security testing requirements at the bank
Forge and maintain strong working relationships with development functions/teams, product delivery teams, project management, third-party management, enterprise architecture, audit teams
Participate in security and technology strategic planning to ensure identified risk governance is incorporated into the CISO enterprise strategy
Partner with business sectors to run delegate action groups that provide recommendations to strengthen development processes and security testing
Appropriately assess risk and provide software security advice when business decisions are made
Interface with Application Security Program Team to oversee Program Projects and Initiatives
Make strategic recommendations to senior managers on standards and policy changes.

Requirements:

Experience or deep knowledge of key activities within software security group such as Threat Modeling / Application Risk Assessment, Vulnerability Assessments, Governance and Metrics, Training
Bachelor's Degree with 4 - 6 years' experience in web application development or application code review
Experience as a technical lead or manager
Knowledge of cloud computing concepts and DevOps tools (OpenShift, Kubernetes, Docker, Chef, etc)
Experience using or testing cloud platforms (AWS, Google, Azure, etc) and security in/of the cloud
Understanding of security, web-based and infrastructure vulnerabilities
Experience in source code management, build and deployment technologies such as RLM, Ueploy, Jenkins, Artifactory, Maven, GitHub, etc
Experience conducting vulnerability assessments and articulating security issues to technical and non-technical audience
Understanding of Snyk, Checkmarx, CDXGen, Dependency Track, Fortify, GitHub Advance Security, Sonatype or Black Duck platform
Knowledge of tools and processes used to expose common vulnerabilities and implement countermeasures
Excellent communication skills (written and verbal) and the ability to communicate with all levels of staff and management
Demonstrated knowledge of recognized security industry standards and leading practices such as FFIEC, NIST, C2M2, ISO
Relevant professional certifications such as GIAC, CISA, CISM, CRISC, CISSP or equivalent desired.

Nice to have:

Experience with Snyk, Checkmarx, CDXGen, Dependency Track, Fortify, GitHub Advance Security, Sonatype or Black Duck platform
Relevant professional certifications such as GIAC, CISA, CISM, CRISC, CISSP or equivalent.

What we offer:

27 days annual leave (plus bank holidays)
A discretional annual performance-related bonus
Private Medical Care & Life Insurance
Employee Assistance Program
Pension Plan
Paid Parental Leave
Special discounts for employees, family, and friends
Access to an array of learning and development resources.

Additional Information:

Job Posted:
September 23, 2025

Employment Type:

Fulltime

Work Type:

On-site work

View All Jobs In This Company

Job Link Share:

Application Security Technical Lead