Applications Development Technical Change Lead - Enterprise Software Vulnerability Remediation & Rapid Patching

The Applications Development Technology Senior Lead Analyst is a senior level position responsible for establishing and implementing new or revised application systems and programs in coordination with the Technology Team. The overall objective of this role is to lead applications systems analysis and programming activities.

Responsibilities:

• Lead integration of functions to meet goals, deploy new products, and enhance processes
• Analyze complex business processes, system processes, and industry standards to define and develop solutions to high level problems
• Provide expertise in area of advanced knowledge of applications programming and plan assignments involving large budgets, cross functional project, or multiple projects
• Develop application methodologies and standards for program analysis, design, coding, testing, debugging, and implementation
• Utilize advanced knowledge of supported main system flows and comprehensive knowledge of multiple areas to achieve technology goals
• Consult with end users to identify system function specifications and incorporate into overall system design
• Allocate work, and act as an advisor/coach developers, analysts, and new team members
• Influence and negotiate with senior leaders and communicate with external parties
• Appropriately assess risk when business decisions are made, demonstrating particular consideration for the firm's reputation and safeguarding Citigroup, its clients and assets, by driving compliance with applicable laws, rules and regulations, adhering to Policy, applying sound ethical judgment regarding personal behavior, conduct and business practices, and escalating, managing and reporting control issues with transparency.

Qualifications:

• 10+ years of relevant experience
• Experience in implementing projects
• Experience in systems analysis and programming of software applications
• Demonstrated Subject Matter Expert (SME) in area(s) of Applications Development
• Demonstrated knowledge of client core business functions
• Demonstrated leadership, project management, and development skills
• Relationship and consensus building skills

Education:

• Bachelor’s degree/University degree or equivalent experience
• Master’s degree preferred

The Senior Vice President (SVP) – Technical Change Lead is a hands-on, high-impact technical leader responsible for actively driving software vulnerability remediation across designated application portfolios. This role works directly at the engineering squad and application level to help teams remediate static code vulnerabilities (SAST), patch vulnerable third-party dependencies and frameworks (SCA), and adopt modern software delivery practices—including containerization and lightweight release mechanics—to achieve same-day hotfix and deployment capabilities.

Operating on the ground as a technical catalyst and problem solver, the SVP partners with application leads to validate remediation plans, coordinates day-to-day execution with external contractor remediation squads, and works alongside internal tooling teams to eliminate developer friction and accelerate patching velocity.

Key Responsibilities & Core Duties

1. Hands-On Remediation Enablement & Same-Day Release Acceleration

• Work directly with software application teams to assess their release pipelines, identify deployment bottlenecks, and implement lightweight release patterns that enable same-day patching of critical security defects.
• Guide and coach development squads on modernizing legacy packaging and transitioning workloads into containerized runtimes (e.g., Docker, Kubernetes, OpenShift), reducing patch blast radius and enabling rapid, repeatable deployments.
• Lead practical, technical workshops and hands-on coding/pairing sessions demonstrating how to refactor insecure code patterns and safely upgrade complex dependencies with zero downtime.

2. Application Plan Review & Technical Feasibility Validation

• Review, critique, and validate vulnerability remediation plans submitted by application teams, ensuring proposals address fundamental code defects and dependency debt rather than temporary workarounds.
• Evaluate technical trade-offs involving breaking API changes in patched libraries, major framework upgrades, and compiler/runtime compatibility.
• Assist application architects in breaking down large remediation initiatives into sprint-sized, testable increments with automated regression validation.

3. Contractor Squad Coordination & Delivery Tracking

• Coordinate day-to-day technical workflows for specialized external contractor squads and staff augmentation engineers assigned to assist application teams with code fixes and dependency updates.
• Review contractor code submissions and pull requests for adherence to enterprise code quality, testing standards, and security requirements.
• Track contractor burn-down rates, triage throughput, and verify that knowledge transfer to permanent application owners occurs seamlessly during the remediation lifecycle.

4. Internal Tooling Adoption & Developer Experience Optimization

• Champion the adoption of developer-centric scanning and remediation tools directly inside engineering workflows (IDE extensions, automated dependency bump bots, localized static analysis, image scanning).
• Gather concrete feedback from developer teams regarding scanning false positives, build breaks, or pipeline delays; partner with internal tooling and developer platform teams to refine scanner configurations and deploy self-service remediation utilities.
• Assist in rolling out centralized vulnerability tracking portals, SBOM management tools, and fast-track change approval pathways for vulnerability patches.

5. Tactical Program Governance & Remediation Tracking

• Monitor and report on portfolio-level remediation health, tracking Mean Time to Remediate (MTTR), Static Code Defect Resolution Velocity, Dependency Patch Aging, and Same-Day Fix Readiness.
• Escalate systemic technical roadblocks, recurring architectural patterns causing vulnerabilities, and infrastructure gaps to the Program Director and relevant platform owners.
• Ensure all completed remediations possess sufficient automated testing and deployment evidence to satisfy internal audit and risk compliance criteria.

Required Qualifications & Experience

Education & Professional Experience

• Bachelor’s Degree in Computer Science, Software Engineering, Information Technology, or related technical field (Master’s degree is a plus).
• 7–15 years of progressive experience in software engineering, application architecture, or technical delivery leadership.
• 3–5+ years in a lead engineer, technical architect, or technical lead role guiding engineering squads, driving code quality improvements, or managing technical debt / software remediation initiatives.
• Demonstrated hands-on experience refactoring software to resolve static code defects (SAST) and managing complex third-party library/framework upgrades across multi-tier applications.
• Experience collaborating with and directing external contractors, vendor delivery teams, or distributed engineering resources.

Technical Proficiencies

• Static Code Analysis & Refactoring: Practical experience interpreting SAST findings (e.g., SonarQube, Checkmarx, Veracode, Fortify) and implementing secure coding patterns in languages such as Java, Python, Go, C#/.NET, or JavaScript/TypeScript.
• Software Dependency Management: Deep familiarity with Software Composition Analysis (SCA) tools (e.g., Snyk, Black Duck, JFrog Xray, Dependabot) and dependency management ecosystems (Maven, Gradle, npm, NuGet, pip).
• Containerization & Cloud-Native Delivery: Hands-on proficiency with container technologies (Docker, OCI), container management platforms (Kubernetes, OpenShift), and container base-image patching strategies.
• Build Automation & Rapid Release: Experience optimizing CI/CD build pipelines (e.g., Jenkins, Tekton, Harness, GitHub Actions), automated test execution, and deployment strategies (canary, blue-green) to facilitate hotfixes and same-day releases.

Core Competencies & Working Style

Competency

Behavioral Expectation

Technical Depth & Credibility

Able to read code, review PRs, and engage peer-to-peer with lead developers and architects to solve real technical blockers.

Hands-On Problem Solver

Proactively jumps into tricky dependency graphs or pipeline issues to help teams find practical paths to resolution.

Empathy & Collaboration

Understands sprint pressures and developer workflows; focuses on streamlining processes and removing toil rather than enforcing rigid bureaucracy.

Clear Communication

Translates complex technical challenges and remediation progress into crisp updates for directors and program managers.

Execution Focus

Driven by measurable outcomes—closing defect counts, reducing patch dwell time, and helping teams achieve same-day deployment capabilities.

Key Performance Indicators (Success Metrics)

• Same-Day Deployment Enablement: Number of assigned application services enabled with containerized pipelines and automated verification to release vulnerability fixes within 24 hours.
• Static Code Remediation Volume: Rate of closed static code (SAST) defects and reduction in high/critical code flaws across the assigned portfolio.
• Third-Party Dependency MTTR: Reduction in the average dwell time of vulnerable open-source and third-party libraries across active repositories.
• Plan Validation Accuracy & Velocity: Turnaround time and execution success rate for application remediation plans reviewed and approved.
• Contractor Utilization & Quality: Quality scores and defect-resolution output delivered by external contractor squads under supervision.

------------------------------------------------------

Job Family Group:

Technology

------------------------------------------------------

Job Family:

Applications Development

------------------------------------------------------

Time Type:

Part time

------------------------------------------------------

Most Relevant Skills

Please see the requirements listed above.

------------------------------------------------------

Other Relevant Skills

For complementary skills, please see above and/or contact the recruiter.

------------------------------------------------------

Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.

If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.

View Citi’s EEO Policy Statement and the Know Your Rights poster.