The AI & Offensive Security Analyst role at Citi is a hands-on position within the Advanced Pentesting & Research team, focusing on offensive security research and AI-powered security tooling. The successful candidate will leverage deep adversarial security expertise alongside AI engineering capabilities to identify and mitigate vulnerabilities in complex systems. This role requires collaboration with engineering, architecture, and risk teams to enhance security intelligence across the firm's technology landscape. Ideal candidates will possess a strong R&D mindset and a passion for staying at the forefront of security and AI research.

• 6+ years of experience in Cyber Security or related field.
• Master’s degree in computer science, Cyber Security or related field with a minimum of 3 years of experience in a penetration testing or application development role OR a Bachelor’s degree in computer science, Cyber Security or related field with a minimum of 5 years of experience in a penetration testing or application development role.
• Hands-on experience with security & Software engineering tooling such as Burp Suite, SAST/DAST scanners, Claude Code, GH copilot, and custom exploit development from CVE advisories.
• Demonstrated proficiency in penetration testing across web, network, and binary domains.
• Strong R&D mindset with the ability to independently identify new research opportunities and translate findings into actionable tooling or defensive improvements.
• Good proficiency in reading, understanding, and working with code, including the ability to navigate unfamiliar codebases and identify logic flaws.

• Perform deep vulnerability research on emerging attack surfaces including LLM-based systems, AI pipelines, model inference endpoints, and prompt injection vectors.
• Design, build, and maintain AI harnesses capable of performing security-related tasks, including autonomous vulnerability scanning agents and AI-driven exploit classification systems.
• Research and prototype novel attack techniques and defensive countermeasures, contributing findings to internal knowledge bases and security engineering standards.
• Analyze source code using both manual review and AI-augmented static analysis to identify and mitigate security weaknesses.
• Conduct offensive security assessments and penetration testing against applications, infrastructure, and AI/ML systems.
• Identify opportunities to automate and standardize information security controls using AI-driven pipelines.

• Citi offers a comprehensive benefits package including competitive pay, stock programs, healthcare coverage, retirement plans, paid time off, parental leave, and programs supporting employee wellbeing and professional development.