{"id":1542932,"url":"https://alion.io/job/citi-senior-network-forensics-packet-capture-engineer","title":"Senior Network Forensics & Packet Capture Engineer","company":{"id":7841,"name":"Citi","domain":"citi.com","url":"https://alion.io/company/citi","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":100,"open_postings":377,"ghost_share":0.008,"stale_share":0.003,"repost_share":0.088,"time_to_fill_p50_days":10,"computed_at":"2026-10-14T06:34:16Z"}},"role":"Networking","role_family":"Networking","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Budapest, Hungary"],"countries":["HU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":31000,"max_usd":75000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":600},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Ansible","optional":false},{"name":"Arkime","optional":false},{"name":"Configuration Management","optional":false},{"name":"Grafana","optional":false},{"name":"InfluxDB","optional":false},{"name":"Linux","optional":false},{"name":"Machine Learning","optional":false},{"name":"OpenSearch","optional":false},{"name":"Prometheus","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"Suricata","optional":false},{"name":"Tcpdump","optional":false},{"name":"Wireshark","optional":false},{"name":"Zeek","optional":false}],"status":"live","first_seen_at":"2026-09-30T21:25:24Z","employer_posted_date":"2026-09-30","last_verified_at":"2026-10-15T02:49:40Z","board_verified":true,"closed_at":null,"days_open":14,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":14},"description":"Citi's Perimeter Reliability Engineering team is seeking a Senior Network Forensics & Packet Capture Engineer to architect, deploy, and operate high-performance full-packet capture infrastructure across Citi's global network perimeter. This is a senior engineering role at the intersection of network visibility, security forensics, and platform automation - building and owning the capture layer that powers enterprise threat detection, SOC investigations, and forensic response. Your work will directly shape the infrastructure that global security teams rely on to detect and investigate sophisticated threats at scale.\nResponsibilities\nDesign and own end-to-end full-packet capture infrastructure across global sites, encompassing TAP aggregation fabrics, out-of-band offload networks, high-throughput NVMe/ZFS storage, and OpenSearch indexing clusters.\nDeploy, tune, and scale Arkime at enterprise level, including capture daemon configuration, BPF filter hierarchies, OpenSearch Index Lifecycle Management, and Viewer customization tailored to SOC analyst workflows.\nEngineer hardware-accelerated packet capture solutions using SmartNICs, kernel-bypass frameworks including DPDK, PF_RING ZC, and AF_XDP, and TAP aggregation platforms to sustain high-throughput capture without packet loss.\nBuild and maintain production-grade Python automation for PCAP archival pipelines, Arkime REST API integrations, OpenSearch lifecycle management, and event-driven packet extraction workflows.\nOperate and extend Zeek for deep protocol metadata extraction, develop custom Zeek scripts, and integrate output into SIEM and threat intelligence platforms.\nLead forensic root cause analysis for complex network security incidents, applying , Wireshark, tshark, tcpdump, and session logs to reconstruct attack timelines and session activity.\nIntegrate PCAP platforms with AI and machine learning threat detection pipelines, including JA3/JA3S TLS fingerprinting and alert-to-packet correlation workflows, to accelerate detection and investigation.\nDevelop Grafana dashboards and alerting pipelines using Prometheus and InfluxDB to provide real-time visibility into capture rates, packet drops, storage consumption, and cluster health.\nRequired Qualifications & Skills\n7 or more years in infrastructure or network security engineering, including a minimum of 3 to 4 years in dedicated packet capture, network forensics, or network visibility roles.\nExpert-level Arkime deployment and operations, including capture daemon tuning, multi-site OpenSearch cluster architecture, and large-scale platform scaling.\nHands-on packet capture infrastructure engineering covering TAP, SPAN, and ERSPAN design, aggregation fabric architecture, out-of-band network design, and storage tiering with NVMe and ZFS.\nProficiency in Python, applied specifically to PCAP lifecycle automation, Arkime API scripting, OpenSearch query pipelines, and infrastructure tooling development.\nExpert-level protocol analysis using Wireshark, tshark, and tcpdump, including advanced filter construction and full session reconstruction.\nLinux performance tuning at the system level, including kernel parameter configuration, NUMA topology awareness, CPU pinning, and NIC queue optimization.\nBachelor's degree in a relevant field or equivalent practical experience; a Master's degree is preferred.\nBeneficial Skills & Qualifications\nHands-on experience with kernel-bypass and SmartNIC capture technologies, including DPDK, PF_RING ZC, AF_XDP\nZeek deployment, configuration, and custom script development for protocol analysis and security data enrichment.\nAnsible for configuration management and infrastructure-as-code deployment of capture environments.\nApplied knowledge of machine learning-based network anomaly detection and flow-level feature engineering for security use cases.\nActive open-source contribution to open-source packet capture projects such as Arkime, Zeek, or Suricata.\nWhat We Offer\nAt Citi, you will work within a high-performance global security engineering team, tackling some of the most technically complex infrastructure challenges in financial services. This role offers real ownership, technical depth, and the opportunity to build systems that operate at global scale and directly support the security of one of the world's largest financial institutions.\nBy joining Citi Hungary, you will not only be part of a business casual workplace with a hybrid working model (up to 2 days working at home per week), but also receive a competitive compensation package and enjoy a whole host of additional benefits that support you (and your family) to be well, live well and save well:\nCafeteria Program\nHome Office Allowance (for colleagues working in hybrid work models)\nPaid Parental Leave Program (maternity and paternity leave)\nPrivate Medical Care Program and onsite medical rooms at our offices\nPension Plan Contribution to voluntary pension fund\nGroup Life Insurance\nEmployee Assistance Program\nAccess to a wide variety of learning and development programs, online course libraries and upskilling platforms, such as Udemy and Degreed\nFlexible work arrangements to support you in managing work - life balance\nCareer progression opportunities across geographies and business lines\nSocially active employee communities with diverse networking opportunities\nundefined\nBuild the infrastructure that keeps one of the world's largest financial institutions secure - apply now to join Citi's Perimeter Reliability Engineering team as a Senior Network Forensics & Packet Capture Engineer.\nAlongside these benefits Citi is committed to ensuring our workplace is where everyone feels comfortable coming to work as their whole self every day. We want the best talent around the world to be energized to join us, motivated to stay, and empowered to thrive.\nSounds like Citi has everything you need?\nThen apply to discover the true extent of your capabilities.\n------------------------------------------------------\nJob Family Group:\nTechnology------------------------------------------------------\nJob Family:\nSystems & Engineering------------------------------------------------------\nTime Type:\nFull time------------------------------------------------------\nPrimary Location Full Time Salary Range:\n17 157 800,00 Ft - 28 767 800,00 Ft------------------------------------------------------\nMost Relevant Skills\nPlease see the requirements listed above.------------------------------------------------------\nOther Relevant Skills\nFor complementary skills, please see above and/or contact the recruiter.------------------------------------------------------\nCiti is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.\nIf you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.\nView Citi’s EEO Policy Statement and the Know Your Rights poster.","description_format":"text","description_chars":7143,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Cafeteria","Flexible schedule","Home office","Hybrid work","Life insurance","Parental leave"],"hiring_locations":[{"name":"Hungary","iso":"HU","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Services","Wealth Management & Financial Advisors","Payment Processing & Gateways","Consumer Loans & Pawnshops"],"lifecycle":[{"event":"open","at":"2026-09-30T21:25:24Z"}],"visa":[],"liveness":{"score":36,"band":"fade","label":"Fading","p_open":1,"p_active":0.658,"p_room":0.55,"age_days":13,"expected_fill_days":10,"reasons":["conf:3","velocity","win:tail","comp:brand"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/citi-senior-network-forensics-packet-capture-engineer","json_url":"https://alion.io/job/citi-senior-network-forensics-packet-capture-engineer.json","meta":{"generated_at":"2026-10-15T04:12:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6047,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7841},"rest":"https://alion.io/mcp/rest/get_company?id=7841"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fciti-senior-network-forensics-packet-capture-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fciti-senior-network-forensics-packet-capture-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fciti-senior-network-forensics-packet-capture-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/citi-senior-network-forensics-packet-capture-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fciti-senior-network-forensics-packet-capture-engineer"}]}