Discover your future at Citi
Working at Citi is far more than just a job. A career with us means joining a team of approximately 219,000 dedicated people from around the globe. At Citi, you'll have the opportunity to grow your career, give back to your community and make a real impact.

Job Overview
The Technical Change Lead is a hands-on, high-impact technical leader responsible for actively driving software vulnerability remediation across designated application portfolios. This role works directly at the engineering squad and application level to help teams remediate static code vulnerabilities (SAST), patch vulnerable third-party dependencies and frameworks (SCA), and adopt modern software delivery practices - including containerization and lightweight release mechanics - to achieve same-day hotfix and deployment capabilities.

Operating on the ground as a technical catalyst and problem solver, the Technical Change Leadpartners with application leads to validate remediation plans, coordinates day-to-day execution with external contractor remediation squads, and works alongside internal tooling teams to eliminate developer friction and accelerate patching velocity.

What you'll do

Hands-On Remediation Enablement & Same-Day Release Acceleration

• Work directly with software application teams to assess their release pipelines, identify deployment bottlenecks, and implement lightweight release patterns that enable same-day patching of critical security defects.
• Guide and coach development squads on modernizing legacy packaging and transitioning workloads into containerized runtimes (e.g., Docker, Kubernetes, OpenShift), reducing patch blast radius and enabling rapid, repeatable deployments.
• Lead practical, technical workshops and hands-on coding/pairing sessions demonstrating how to refactor insecure code patterns and safely upgrade complex dependencies with zero downtime.

Application Plan Review & Technical Feasibility Validation

• Review, critique, and validate vulnerability remediation plans submitted by application teams, ensuring proposals address fundamental code defects and dependency debt rather than temporary workarounds.
• Evaluate technical trade-offs involving breaking API changes in patched libraries, major framework upgrades, and compiler/runtime compatibility.
• Assist application architects in breaking down large remediation initiatives into sprint-sized, testable increments with automated regression validation.

Contractor Squad Coordination & Delivery Tracking

• Coordinate day-to-day technical workflows for specialized external contractor squads and staff augmentation engineers assigned to assist application teams with code fixes and dependency updates.
• Review contractor code submissions and pull requests for adherence to enterprise code quality, testing standards, and security requirements.
• Track contractor burn-down rates, triage throughput, and verify that knowledge transfer to permanent application owners occurs seamlessly during the remediation lifecycle.

Internal Tooling Adoption & Developer Experience Optimization

• Champion the adoption of developer-centric scanning and remediation tools directly inside engineering workflows (IDE extensions, automated dependency bump bots, localized static analysis, image scanning).
• Gather concrete feedback from developer teams regarding scanning false positives, build breaks, or pipeline delays; partner with internal tooling and developer platform teams to refine scanner configurations and deploy self-service remediation utilities.
• Assist in rolling out centralized vulnerability tracking portals, SBOM management tools, and fast-track change approval pathways for vulnerability patches.

Tactical Program Governance & Remediation Tracking

• Monitor and report on portfolio-level remediation health, tracking Mean Time to Remediate (MTTR), Static Code Defect Resolution Velocity, Dependency Patch Aging, and Same-Day Fix Readiness.
• Escalate systemic technical roadblocks, recurring architectural patterns causing vulnerabilities, and infrastructure gaps to the Program Director and relevant platform owners.
• Ensure all completed remediations possess sufficient automated testing and deployment evidence to satisfy internal audit and risk compliance criteria.

What we'll need from you

• Education & Professional Experience
  • Bachelor's Degree in Computer Science, Software Engineering, Information Technology, or related technical field (Master's degree is a plus).
  • 7-15 years of progressive experience in software engineering, application architecture, or technical delivery leadership.
  • 3-5+ years in a lead engineer, technical architect, or technical lead role guiding engineering squads, driving code quality improvements, or managing technical debt / software remediation initiatives.
  • Demonstrated hands-on experience refactoring software to resolve static code defects (SAST) and managing complex third-party library/framework upgrades across multi-tier applications.
  • Experience collaborating with and directing external contractors, vendor delivery teams, or distributed engineering resources.

• Technical Proficiencies
  • Static Code Analysis & Refactoring: Practical experience interpreting SAST findings (e.g., SonarQube, Checkmarx, Veracode, Fortify) and implementing secure coding patterns in languages such as Java, Python, Go, C#/.NET, or JavaScript/TypeScript.
  • Software Dependency Management: Deep familiarity with Software Composition Analysis (SCA) tools (e.g., Snyk, Black Duck, JFrog Xray, Dependabot) and dependency management ecosystems (Maven, Gradle, npm, NuGet, pip).
  • Containerization & Cloud-Native Delivery: Hands-on proficiency with container technologies (Docker, OCI), container management platforms (Kubernetes, OpenShift), and container base-image patching strategies.
  • Build Automation & Rapid Release: Experience optimizing CI/CD build pipelines (e.g., Jenkins, Tekton, Harness, GitHub Actions), automated test execution, and deployment strategies (canary, blue-green) to facilitate hotfixes and same-day releases.

Core Competencies

Technical Depth & Credibility: Able to read code, review PRs, and engage peer-to-peer with lead developers and architects to solve real technical blockers.

Hands-On Problem Solver: Proactively jumps into tricky dependency graphs or pipeline issues to help teams find practical paths to resolution.Empathy & Collaboration: Und