{"id":1542956,"url":"https://alion.io/job/citi-threat-exposure-management-platform-engineer","title":"Threat & Exposure Management Platform Engineer","company":{"id":7841,"name":"Citi","domain":"citi.com","url":"https://alion.io/company/citi","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":100,"open_postings":448,"ghost_share":0.007,"stale_share":0.098,"repost_share":0.083,"time_to_fill_p50_days":10,"computed_at":"2026-10-23T05:54:15Z"}},"role":"DevOps","role_family":"DevOps","seniority":"staff","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Irving, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":156160,"max":234240,"currency":"USD","period":"year","gross":null,"usd_annual":234240},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Apache Kafka","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"CVSS","optional":false},{"name":"EPSS","optional":false},{"name":"Flink","optional":false},{"name":"GCP","optional":false},{"name":"GraphQL","optional":false},{"name":"Java","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Self-Healing","optional":false},{"name":"SIEM","optional":false},{"name":"Spark","optional":false},{"name":"Time Series","optional":false}],"status":"live","first_seen_at":"2026-09-29T00:00:00Z","employer_posted_date":"2026-09-29","last_verified_at":"2026-10-23T14:46:42Z","board_verified":true,"closed_at":null,"days_open":24,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":24},"description":"We are looking for a highly experienced Threat & Exposure Management Platform Engineer to design, build, and operate the data platform and architecture that unifies threat, vulnerability, and exposure signal across the enterprise. This is a foundational, high-impact platform engineering role at the core of our organization's evolution toward a next-generation, AI-enabled security operations capability.\nYou will own the architecture connecting security tooling, threat intelligence, vulnerability data, and adversary validation results into a single, continuously updated substrate - enabling faster, more accurate, and increasingly automated risk prioritization and response across the business.\nThis role calls for someone with deep platform engineering expertise and strong architectural judgment, comfortable owning complex, mission-critical systems end-to-end rather than working on isolated components.\nKey Responsibilities\n Data Pipeline Engineering: Design, build, and operate scalable, resilient data pipelines that ingest, normalize, and enrich threat and exposure signals from a wide range of security, IT, and cloud platforms (e.g., vulnerability scanners, EDR/XDR, CSPM, CMDB, threat intelligence feeds, identity systems).\nPlatform Integration: Develop and maintain robust API integrations connecting security tooling, data lakes, and correlation/analytics engines to create a single, unified view of the organization's threat and exposure posture.\nCorrelation Engine Development: Architect and implement correlation logic and data models that link vulnerabilities, threats, assets, and business context to support automated, evidence-based risk prioritization.\n Data Substrate & Architecture Ownership: Build and evolve the underlying data substrate (schemas, storage layers, streaming infrastructure) that serves as the authoritative source of truth for enterprise risk and exposure data, and own its long-term architectural direction.\nAPI & Interface Development: Expose clean, well-documented, secure APIs enabling downstream systems, dashboards, and analyst tooling to consume unified threat and exposure data programmatically.\nContinuous Exposure Lifecycle Support: Build and operate the platform capabilities that support an ongoing, iterative approach to discovering, prioritizing, and validating exposures across the environment - from initial scoping through to remediation tracking.\nAdversary-Informed Validation Integration: Integrate outputs from adversary emulation, control validation, and simulation exercises into the correlation engine, enriching risk prioritization with real-world evidence of exploitability and defensive effectiveness.\nCoverage & Gap Analysis: Architect data models and pipelines that continuously assess defensive coverage against real-world attack techniques, surfacing prioritized gaps for remediation.\nOperational Reliability: Own the uptime, performance, scalability, and data quality of production pipelines and integrations; implement monitoring, alerting, and self-healing mechanisms.\nCross-Platform Normalization: Establish common taxonomies and data standards to reconcile inconsistent data formats, severity scoring, and asset identifiers across heterogeneous security tools.\nCross-Functional Collaboration: Partner with security operations, threat intelligence, detection engineering, red/purple team, and data science functions to ensure platform outputs meet operational and analytical needs.\nSecurity & Compliance: Ensure all data handling, storage, and access adhere to enterprise security, privacy, and regulatory requirements, given the sensitivity of threat and exposure data.\nAutomation & Scale: Drive automation of data onboarding for new tools and platforms to reduce integration lead time as the environment and tool ecosystem grow.\nDocumentation & Knowledge Transfer: Maintain architecture diagrams, runbooks, and integration documentation to support platform sustainability and team scaling.\nRequired Skills & Experience\nStrong architecture skills - demonstrated ability to design end-to-end platform architectures spanning data ingestion, correlation, validation, and delivery layers, with sound judgment on scalability, extensibility, and long-term maintainability.\nDeep platform engineering expertise - a proven track record owning and operating complex, production-grade security data platforms end-to-end.\nHands-on experience building large-scale data pipelines (batch and streaming) using tools such as Kafka, Spark, Airflow, Flink, or equivalent.\nStrong expertise in API design and development (REST/GraphQL), including authentication, rate limiting, and versioning for high-throughput data.\nProven experience integrating heterogeneous security platforms (vulnerability management, EDR/XDR, CSPM, SIEM, CMDB, threat intelligence platforms, simulation/emulation tooling).\nStrong background in data modeling and correlation engine design - able to reconcile asset, vulnerability, threat, and adversary-behavior data into unified risk views.\nPractical understanding of how to operationalize an ongoing exposure discovery, prioritization, and validation process within a technical platform.\nFamiliarity with mapping known attacker techniques and behaviors to defensive controls and detection coverage.\nFamiliarity with simulation or emulation-based control validation approaches and how their outputs feed into broader risk models.\nProficiency in at least one major programming language (Python, Go, or Java) for pipeline and integration development.\nExperience with cloud-native data infrastructure (AWS/Azure/GCP), including data lakes, warehouses, and event-driven architectures.\nSolid understanding of core cybersecurity concepts: vulnerability management, threat intelligence, exposure management, attack surface management, and risk scoring frameworks (e.g., CVSS, EPSS).\nExperience with database technologies spanning relational, NoSQL, graph, and time-series stores for correlation and attack-path use cases.\nStrong software engineering fundamentals: CI/CD, infrastructure-as-code, version control, testing, and observability practices.\nExcellent cross-functional collaboration skills, able to work with security operations, detection engineering, and platform architecture teams in a fast-paced, mission-critical environment.\nPreferred Qualifications\n10+ yrs of experience leading a continuous exposure management program or initiative end-to-end, from architecture through operational rollout.\nFamiliarity with graph-based attack path analysis or asset/risk graphs.\nHands-on experience with adversary simulation or emulation frameworks and purple-team tooling.\nExperience supporting AI/ML-driven security operations or automation-first security initiatives.\nRelevant certifications (e.g., GIAC, cloud security or data certifications) are a plus but not required in lieu of hands-on expertise.\nWhat We're Looking For\nA builder who thrives on architecting and operating complex, high-stakes data platforms - someone equally comfortable in deep technical design discussions and hands-on implementation, who wants to shape the data foundation behind the next generation of automated, intelligence-driven security operations.\n Education:\nBachelor’s degree/University degree or equivalent experience\nMaster’s degree preferred\nThis job description provides a high-level review of the types of work performed. Other job-related duties may be assigned as required.\n------------------------------------------------------\nJob Family Group:\nTechnology------------------------------------------------------\nJob Family:\nInformation Security------------------------------------------------------\nTime Type:\nFull time------------------------------------------------------\nPrimary Location:\nIrving Texas United States------------------------------------------------------\nPrimary Location Full Time Salary Range:\n$156,160.00 - $234,240.00In addition to salary, Citi’s offerings may also include, for eligible employees, discretionary and formulaic incentive and retention awards. Citi offers competitive employee benefits, including: medical, dental & vision coverage; 401(k); life, accident, and disability insurance; and wellness programs. Citi also offers paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays. For additional information regarding Citi employee benefits, please visit citibenefits.com. Available offerings may vary by jurisdiction, job level, and date of hire.\n------------------------------------------------------\nMost Relevant Skills\nPlease see the requirements listed above.------------------------------------------------------\nOther Relevant Skills\nFor complementary skills, please see above and/or contact the recruiter.------------------------------------------------------\nAnticipated Posting Close Date:\nOct 25, 2026------------------------------------------------------\nAutomated Processing and AI\nWe use automated processing, including artificial intelligence, for our legitimate business interests (or our reasonable and appropriate business purposes) to identify and align the candidate's skills and abilities with a specific job opening. Additionally, if you so choose, or consent, we can match your skills and abilities to other suitable roles at Citi.\nImportantly, all our hiring processes and decisions, including determining your suitability for a role, are conducted, checked, and decided by individuals. Our automated processing and AI do not involve relying on automatic or autonomous decision-making. Please refer to any Jurisdictional Considerations, with specific provisions for your country (where relevant) for further details.\nIllinois residents - AI Notice and Right\n------------------------------------------------------\nCiti is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.\nIf you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.\nView Citi’s EEO Policy Statement and the Know Your Rights poster.","description_format":"text","description_chars":10323,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Wellness"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Services","Wealth Management & Financial Advisors","Payment Processing & Gateways","Consumer Loans & Pawnshops"],"lifecycle":[{"event":"open","at":"2026-09-30T21:25:24Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":22,"band":"cold","label":"Long shot","p_open":1,"p_active":0.621,"p_room":0.35,"age_days":24,"expected_fill_days":10,"reasons":["conf:0","velocity","win:tail","comp:brand"],"computed_at":"2026-10-23T05:54:15Z"},"pay":{"stated_usd_annual":234240,"is_top_pay":true},"html_url":"https://alion.io/job/citi-threat-exposure-management-platform-engineer","json_url":"https://alion.io/job/citi-threat-exposure-management-platform-engineer.json","meta":{"generated_at":"2026-10-23T17:27:17Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26525,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7841},"rest":"https://alion.io/mcp/rest/get_company?id=7841"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fciti-threat-exposure-management-platform-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fciti-threat-exposure-management-platform-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fciti-threat-exposure-management-platform-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/citi-threat-exposure-management-platform-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fciti-threat-exposure-management-platform-engineer"}]}