> Markdown version of [/jobs/ext/4294400-senior-software-engineer-technical-remediation-enablement](https://www.wearedevelopers.com/jobs/ext/4294400-senior-software-engineer-technical-remediation-enablement). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Software Engineer Technical Remediation & Enablement - **Company:** Citi - **Location:** New York, NY, United States - **Experience:** Expert - **Salary:** $142,320.0 - $213,480.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), .NET Framework, Data Analysis, Component-Based Software Engineering, Software Applications, C Sharp (Programming Language), Static Program Analysis, Code Coverage, Information Systems, Computer Programming, Continuous Integration, Software Debugging, Programming Tools, Github, Gradle, Systems Analysis, Python (Programming Language), Apache Maven, Node.Js, NuGet, OpenShift, Package Management Systems, Regression Testing, Fortify (Software), Software Engineering, SonarQube, TypeScript, Web Applications, Enterprise Software Applications, Apache Yarn, Delivery Pipeline, Spring-boot, Software Application Programming, Veracode, Backend, Git, Containerization, Gitlab-ci, Git Flow, Kubernetes, Information Technology, Build Tools, Npm(Software), Checkmarx, Software Coding, Oracle Cloud Infrastructure, Software Version Control, Docker, Jenkins, Static Application Security Testing, Golang, Microservices - **Published:** October 31, 2026 - **Apply:** https://citi.wd5.myworkdayjobs.com/2/job/New-York-New-York-United-States/Senior-Software-Engineer-Technical-Remediation---Enablement_261004162-1/apply ## About the Role * 6-10 years of relevant experience in Apps Development or systems analysis role * Extensive experience system analysis and in programming of software applications * Experience in managing and implementing successful projects * Subject Matter Expert (SME) in at least one area of Applications Development * Ability to adjust priorities quickly as circumstances dictate * Demonstrated leadership and project management skills * Consistently demonstrates clear and concise written and verbal communication Education: * Bachelor's degree/University degree or equivalent experience * Master's degree preferred, Education & Experience Requirements * Bachelor's Degree in Computer Science, Software Engineering, Information Systems, or related technical field. * 4-7 years of hands-on software development and engineering experience delivering enterprise web applications, microservices, or distributed backend systems. * Proven track record of directly fixing static code vulnerabilities (SAST) and managing third-party dependency/package upgrades in production environments. * Practical, hands-on experience containerizing applications and working with container orchestration platforms (Docker, Kubernetes, OpenShift)., * Core Programming Languages: Strong, hands-on development proficiency in at least one or two primary enterprise languages: Java (Spring Boot), Python, Go, C#/.NET, or TypeScript/Node.js. * Static Code Analysis (SAST): Ability to analyze and fix scanner findings from tools such as SonarQube, Checkmarx, Veracode, or Fortify. * Dependency & Package Management: Practical experience with dependency resolution and build tools: Maven, Gradle, npm/yarn, NuGet, pip/Poetry, or Go modules, alongside SCA tools like Snyk, Black Duck, or JFrog Xray. * Containers & Runtime: Hands-on experience creating production-grade Dockerfiles, managing multi-stage builds, patching container base images, and deploying to Kubernetes or OpenShift. * CI/CD & Version Control: Proficient with Git, branching strategies (Gitflow/trunk-based), and pipeline configurations (e.g., Jenkins, GitHub Actions, Tekton, GitLab CI, Harness)., Hands-On Craftsmanship Loves writing code, debugging builds, untangling messy dependency trees, and seeing clean PRs merged to production. Developer-to-Developer Empathy Speaks the language of squad engineers, troubleshoots shoulder-to-shoulder, and offers practical solutions rather than abstract advice. Pragmatic Problem Solver Able to quickly find safe workarounds or code refactors when direct library upgrades introduce breaking API changes. ## Description The Applications Development Technology Lead Analyst is a senior level position responsible for establishing and implementing new or revised application systems and programs in coordination with the Technology team. The overall objective of this role is to lead applications systems analysis and programming activities., * Partner with multiple management teams to ensure appropriate integration of functions to meet goals as well as identify and define necessary system enhancements to deploy new products and process improvements * Resolve variety of high impact problems/projects through in-depth evaluation of complex business processes, system processes, and industry standards * Provide expertise in area and advanced knowledge of applications programming and ensure application design adheres to the overall architecture blueprint * Utilize advanced knowledge of system flow and develop standards for coding, testing, debugging, and implementation * Develop comprehensive knowledge of how areas of business, such as architecture and infrastructure, integrate to accomplish business goals * Provide in-depth analysis with interpretive thinking to define issues and develop innovative solutions * Serve as advisor or coach to mid-level developers and analysts, allocating work as necessary * Appropriately assess risk when business decisions are made, demonstrating particular consideration for the firm's reputation and safeguarding Citigroup, its clients and assets, by driving compliance with applicable laws, rules and regulations, adhering to Policy, applying sound ethical judgment regarding personal behavior, conduct and business practices, and escalating, managing and reporting control issues with transparency., * Write, refactor, and review application code to directly remediate static code analysis (SAST) findings (e.g., SQL/command injection, cross-site scripting, insecure deserialization, improper error handling, weak cryptography). * Resolve complex third-party library and framework upgrades (SCA/CVE remediation), managing transitive dependency conflicts, breaking API changes, and version incompatibilities across Java, Python, Go, .NET, or JavaScript/TypeScript stacks. * Implement targeted automated unit, integration, and regression tests to validate that code fixes and patched libraries do not introduce functional regressions. 2. Containerization & Same-Day Release Enablement * Work directly in application repositories to write and optimize Dockerfiles, container manifests, and base image configurations (Docker, OCI, Kubernetes/OpenShift). * Assist application squads in containerizing non-containerized legacy services, establishing minimal base images and automated base-image rebuild triggers for same-day OS/runtime patching. * Help configure and fine-tune CI/CD build scripts and release pipelines to compress deployment cycle times and eliminate manual deployment steps for emergency hotfixes. 3. Application Plan Technical Validation * Perform code-level reviews of proposed remediation plans from application teams, verifying whether proposed library version bumps or refactored logic effectively eliminate the root cause of the vulnerability. * Identify technical prerequisites (e.g., test coverage gaps, build tool upgrades, compiler/runtime updates) needed before a team can successfully patch and release. 4. Contractor Squad Pairing & PR Review * Act as a peer reviewer and technical guide for external contractor engineers assigned to assist with remediation work. * Review contractor-submitted pull requests (PRs) for code cleanliness, security correctness, test coverage, and enterprise architectural standards. * Facilitate smooth technical onboarding and repository access for contractor developers. 5. Internal Tooling Adoption & Developer Feedback * Actively pilot, adopt, and demonstrate internal developer tools, IDE security plugins, automated PR bots (e.g., Dependabot/Renovate patterns), and local scanning utilities within engineering squads. * Troubleshoot false positives, scanner configuration errors, and build pipeline failures; provide direct, actionable feedback to internal platform and tooling teams to improve developer experience., Explains the "why" and "how" of security fixes clearly in PR comments, documentation, and pairing sessions. Key Performance Indicators (Success Metrics) * Direct Remediation Output: Number of validated PRs merged and critical/high vulnerabilities (SAST & SCA) successfully resolved across assigned services. * Same-Day Hotfix Readiness: Number of application components successfully containerized and equipped with automated verification pipelines capable of same-day hotfix releases. * Turnaround Time for Technical Reviews: Fast, reliable review turnaround for application remediation plans and contractor pull requests. * Build & Release Optimization: Measurable reduction in build and deployment friction for patched releases within supported application squads.