The Threat & Exposure Management Platform Engineer will design, build, and operate a data platform that integrates threat, vulnerability, and exposure signals across the enterprise. This high-impact role is essential for advancing the organization's AI-enabled security operations capabilities. The engineer will be responsible for the architecture connecting various security tools and data sources, ensuring accurate risk prioritization and response. The position requires deep platform engineering expertise and the ability to manage complex systems end-to-end.

• Strong architecture skills with the ability to design end-to-end platform architectures.
• Deep platform engineering expertise with a proven track record in operating complex security data platforms.
• Hands-on experience building large-scale data pipelines using tools such as Kafka, Spark, Airflow, or Flink.
• Strong expertise in API design and development, including REST/GraphQL.
• Proven experience integrating heterogeneous security platforms.
• Strong background in data modeling and correlation engine design.
• Practical understanding of operationalizing exposure discovery and validation processes.
• Familiarity with mapping attacker techniques to defensive controls.
• Proficiency in at least one major programming language such as Python, Go, or Java.
• Experience with cloud-native data infrastructure including data lakes and event-driven architectures.
• Solid understanding of core cybersecurity concepts.
• Experience with various database technologies for correlation and attack-path use cases.
• Strong software engineering fundamentals including CI/CD and version control.
• Excellent cross-functional collaboration skills.

• Design, build, and operate scalable data pipelines that ingest and enrich threat signals.
• Develop and maintain API integrations connecting security tooling and data lakes.
• Architect and implement correlation logic and data models for risk prioritization.
• Build and evolve the underlying data substrate for enterprise risk data.
• Expose secure APIs for downstream systems to consume threat data.
• Support ongoing discovery, prioritization, and validation of exposures.
• Integrate outputs from adversary emulation into the correlation engine.
• Architect data models that assess defensive coverage against attack techniques.
• Own the uptime and performance of production pipelines and integrations.
• Establish common taxonomies to reconcile inconsistent data formats.
• Collaborate with cross-functional teams to meet operational needs.
• Ensure compliance with security and regulatory requirements.
• Drive automation of data onboarding for new tools.
• Maintain documentation to support platform sustainability.

• Citi offers a comprehensive benefits package including competitive pay, stock programs, healthcare coverage, retirement plans, paid time off, parental leave, and programs supporting employee wellbeing and professional development.