Technical Change Lead

The Technical Change Lead is a hands-on, high-impact technical leader responsible for actively driving software vulnerability remediation across designated application portfolios. This role works directly at the engineering squad and application level to help teams remediate static code vulnerabilities (SAST), patch vulnerable third-party dependencies and frameworks (SCA), and adopt modern software delivery practices - including containerization and lightweight release mechanics - to achieve same-day hotfix and deployment capabilities.

Operating on the ground as a technical catalyst and problem solver, the Technical Change Lead partners with application leads to validate remediation plans, coordinates day-to-day execution with external contractor remediation squads, and works alongside internal tooling teams to eliminate developer friction and accelerate patching velocity.

What you’ll do 

Hands-On Remediation Enablement & Same-Day Release Acceleration

• Work directly with software application teams to assess their release pipelines, identify deployment bottlenecks, and implement lightweight release patterns that enable same-day patching of critical security defects.
• Guide and coach development squads on modernizing legacy packaging and transitioning workloads into containerized runtimes (e.g., Docker, Kubernetes, OpenShift), reducing patch blast radius and enabling rapid, repeatable deployments.
• Lead practical, technical workshops and hands-on coding/pairing sessions demonstrating how to refactor insecure code patterns and safely upgrade complex dependencies with zero downtime.

Application Plan Review & Technical Feasibility Validation

• Review, critique, and validate vulnerability remediation plans submitted by application teams, ensuring proposals address fundamental code defects and dependency debt rather than temporary workarounds.
• Evaluate technical trade-offs involving breaking API changes in patched libraries, major framework upgrades, and compiler/runtime compatibility.
• Assist application architects in breaking down large remediation initiatives into sprint-sized, testable increments with automated regression validation.

Contractor Squad Coordination & Delivery Tracking

• Coordinate day-to-day technical workflows for specialized external contractor squads and staff augmentation engineers assigned to assist application teams with code fixes and dependency updates.
• Review contractor code submissions and pull requests for adherence to enterprise code quality, testing standards, and security requirements.
• Track contractor burn-down rates, triage throughput, and verify that knowledge transfer to permanent application owners occurs seamlessly during the remediation lifecycle.

Internal Tooling Adoption & Developer Experience Optimization

• Champion the adoption of developer-centric scanning and remediation tools directly inside engineering workflows (IDE extensions, automated dependency bump bots, localized static analysis, image scanning).
• Gather concrete feedback from developer teams regarding scanning false positives, build breaks, or pipeline delays; partner with internal tooling and developer platform teams to refine scanner configurations and deploy self-service remediation utilities.
• Assist in rolling out centralized vulnerability tracking portals, SBOM management tools, and fast-track change approval pathways for vulnerability patches.

Tactical Program Governance & Remediation Tracking

• Monitor and report on portfolio-level remediation health, tracking Mean Time to Remediate (MTTR), Static Code Defect Resolution Velocity, Dependency Patch Aging, and Same-Day Fix Readiness.
• Escalate systemic technical roadblocks, recurring architectural patterns causing vulnerabilities, and infrastructure gaps to the Program Director and relevant platform owners.
• Ensure all completed remediations possess sufficient automated testing and deployment evidence to satisfy internal audit and risk compliance criteria.

What we’ll need from you 

• Education & Professional Experience
  • Education: Bachelor’s or Master’s degree in Computer Science, Software Engineering, or equivalent technical field.

• • Domain Mastery: Comprehensive track record of delivering enterprise-scale software solutions, robust application architectures, and end-to-end technical initiatives.

• • Leadership & Governance: Established background as a Lead Engineer or Technical Architect with demonstrated success steering multidisciplinary squads, establishing software engineering best practices, and executing complex remediation and technical debt strategies.

• • Application Security & Lifecycle Management: In-depth, practical experience identifying and resolving SAST/security vulnerabilities, as well as managing major version upgrades for critical third-party dependencies across distributed systems.

• • Resource & Stakeholder Management: Demonstrated competence in aligning, directing, and collaborating with cross-functional vendor partners, managed service providers, and distributed technical talent.

• Technical Proficiencies
  • Static Code Analysis & Refactoring: Practical experience interpreting SAST findings (e.g., SonarQube, Checkmarx, Veracode, Fortify) and implementing secure coding patterns in languages such as Java, Python, Go, C#/.NET, or JavaScript/TypeScript.
  • Software Dependency Management: Deep familiarity with Software Composition Analysis (SCA) tools (e.g., Snyk, Black Duck, JFrog Xray, Dependabot) and dependency management ecosystems (Maven, Gradle, npm, NuGet, pip).
  • Containerization & Cloud-Native Delivery: Hands-on proficiency with container technologies (Docker, OCI), container management platforms (Kubernetes, OpenShift), and container base-image patching strategies.
  • Build Automation & Rapid Release: Experience optimizing CI/CD build pipelines (e.g., Jenkins, Tekton, Harness, GitHub Actions), automated test execution, and deployment strategies (canary, blue-green) to facilitate hotfixes and same-day releases.

• Core Competencies
  • Technical Depth & Credibility: Able to read code, review PRs, and engage peer-to-peer with lead developers and architects to solve real technical blockers.
  • Hands-On Problem Solver: Proactively jumps into tricky dependency graphs or pipeline issues to help teams find practical paths to resolution.
  • Empathy & Collaboration: Understands sprint pressures and developer workflows; focuses on streamlining processes and removing toil rather than enforcing rigid bureaucracy.
  • Clear Communication: Translates complex technical challenges and remediation progress into crisp updates for directors and program managers.
  • Execution Focus: Driven by measurable outcomes - closing defect counts, reducing patch dwell time, and helping teams achieve same-day deployment capabilities.

• Key Performance Indicators (Success Metrics)
  • Same-Day Deployment Enablement: Number of assigned application services enabled with containerized pipelines and automated verification to release vulnerability fixes within 24 hours.
  • Static Code Remediation Volume: Rate of closed static code (SAST) defects and reduction in high/critical code flaws across the assigned portfolio.
  • Third-Party Dependency MTTR: Reduction in the average dwell time of vulnerable open-source and third-party libraries across active repositories.
  • Plan Validation Accuracy & Velocity: Turnaround time and execution success rate for application remediation plans reviewed and approved.
  • Contractor Utilization & Quality: Quality scores and defect-resolution output delivered by external contractor squads under supervision.

What we can offer you 

We work hard to have a positive financial and social impact on the communities we serve. In turn, we put our employees first and provide the best-in-class benefits they need to be well, live well and save well. 

By joining Citi London, you will not only be part of a business casual workplace with a hybrid working model (up to 2 days working at home per week), but also receive a competitive base salary (which is annually reviewed), and enjoy a whole host of additional benefits such as:  

• Generous holiday allowance starting at 27 days plus bank holidays; increasing with tenure 
• A discretional annual performance related bonus  
• Private medical insurance packages to suit your personal circumstances 
• Employee Assistance Program   
• Pension Plan  
• Paid Parental Leave  
• Special discounts for employees, family, and friends  
• Access to an array of learning and development resources  

Alongside these benefits Citi is committed to ensuring our workplace is where everyone feels comfortable coming to work as their whole self every day.  We want the best talent around the world to be energized to join us, motivated to stay, and empowered to thrive.  

Sounds like Citi has everything you need? Then apply to discover the true extent of your capabilities.  

------------------------------------------------------

Job Family Group:

Technology

------------------------------------------------------

Job Family:

Applications Development

------------------------------------------------------

Time Type:

Full time

------------------------------------------------------

Most Relevant Skills

Please see the requirements listed above.

------------------------------------------------------

Other Relevant Skills

For complementary skills, please see above and/or contact the recruiter.

------------------------------------------------------

Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.

If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.

View Citi’s EEO Policy Statement and the Know Your Rights poster.