This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
Are you looking for a career move that will place you in a global financial organization? Then bring your skills in fraudanalysis, cyber threat intelligence, financial crime investigation and communication to Citi's CSIS Team. By joining Citi, you will become part of a global organization whose mission is to serve as a trusted partner to our clients by responsibly providing financial services that enable growth and economic progress.
Job Responsibility
Serve as the primary subject matter expert on business email compromise, wire fraud, and cyber-enabled financial crime, maintaining current and comprehensive knowledge of actor methodologies, fraud typologies, and evolving attack vector.
Apply in-depth disciplinary knowledge to triage, process, analyze, intelligence alerts, reports, and briefings
Monitor and research cyber threats (with a strong focus on Business Email Compromise (BEC) and wire fraud) with a direct or indirect impact to the Citi brand
Monitor open-source, dark web, and proprietary intelligence sources for emerging BEC campaigns, compromised credential markets, fraudulent domain registrations, and threat actor communications targeting financial institutions and their clients
Assess cyber threat data and correlate with existing understanding of cyber threats impacting the Citi franchise
Ascertain the impact of an attack and develop threat trends to assess their overall impact and inform senior decision makers
Produce timely, accurate, and actionable intelligence reports, bulletins, and briefings for consumption by fraud operations, client advisory teams, compliance, legal, and senior leadership stakeholders.
Engage in liaison activities with intelligence communities, law enforcement, industry partners, peer financial institutions, and information sharing communities
Complete the daily operational components of the intelligence mission
Assume informal/formal mentor role within teams and assist with the coaching and training of new team members
Requirements
5+ years of experience in a combination of cyber threat intelligence, financial crime investigation, fraud analysis, or law enforcement roles with a focus on BEC, wire fraud, or cyber-enabled financial crime. Prior experience in a financial institution, government agency, law enforcement, or financial intelligence unit (FIU) environment is strongly preferred.
advanced degrees are welcomed, preferably in a STEM major, computer science, cyber security, or cyber technology.
Certifications from EC-Council, GIAC, (ISC)² [CISSP, C/EH, GCIA, CCNA] or relevant technical or specialty areas are a plus, or willingness to earn within 12 months of joining.
Subject matter expertise in business email compromise — including vendor email compromise (VEC), CEO fraud, payroll diversion, real estate wire fraud, and invoice manipulation schemes — with a thorough understanding of actor tactics, techniques, and procedures at each stage of the attack lifecycle.
Strong understanding of the industry's most frequently targeted by BEC actors, including real estate and title companies, legal firms, healthcare, manufacturing, construction, government contractors, and financial services, with the ability to tailor intelligence products to sector-specific risk profiles.
Proficiency in open-source intelligence (OSINT) techniques including domain and email header analysis, WHOIS and passive DNS investigation, social media intelligence, dark web monitoring, and fraudulent infrastructure identification.
Experience with link analysis platforms such as Palantir, Maltego, or i2 Analyst's Notebook to map actor networks, financial flows, and entity relationships across complex multi-jurisdictional cases.
Working knowledge of financial crime typologies including trade-based money laundering, layering techniques, and the use of cryptocurrency exchanges and peer-to-peer platforms to convert and obscure BEC proceeds.
Experience with scripting languages such as Python or similar tools for automating intelligence collection, data enrichment, and pattern analysis across large datasets.
Excellent written and verbal communication skills, with demonstrated ability to produce clear, concise, and well-structured intelligence products for both technical investigators and non-technical business stakeholders.
Proven analytical skills including the ability to synthesize large volumes of structured and unstructured data, identify meaningful patterns, and draw sound, evidence-based conclusions under time pressure.
Proven relationship management and influencing skills, with experience collaborating across fraud operations, compliance, legal, technology, and external law enforcement or government partners.
Nice to have
Certifications from EC-Council, GIAC, (ISC)² [CISSP, C/EH, GCIA, CCNA] or relevant technical or specialty areas are a plus
Advanced degrees are welcomed, preferably in a STEM major, computer science, cyber security, or cyber technology.
What we offer
Cafeteria Program
Home Office Allowance (for colleagues working in hybrid work models)
Paid Parental Leave Program (maternity and paternity leave)
Private Medical Care Program and onsite medical rooms at our offices
Pension Plan Contribution to voluntary pension fund
Group Life Insurance
Employee Assistance Program
Access to a wide variety of learning and development programs, online course libraries and upskilling platforms, such as Udemy and Degreed
Flexible work arrangements to support you in managing work - life balance
Career progression opportunities across geographies and business lines
Socially active employee communities with diverse networking opportunities