The **Vice President (VP) / Senior Software Engineer – Technical Remediation & Enablement Lead** is a hands-on, code-level technical specialist responsible for driving the direct remediation of software vulnerabilities across enterprise application teams.

This individual contributor / team-level technical lead works alongside application developers and contractor engineers to fix static code vulnerabilities (SAST), patch vulnerable software dependencies (SCA/third-party libraries), containerize workloads, and streamline local build/release pipelines to achieve **same-day vulnerability hotfix and deployment capabilities** .

This role combines active software engineering (writing/refactoring code and debugging pipelines) with technical enablement, guiding squad developers on how to adopt internal security and build tools, resolve tricky dependency conflicts, and package applications into modern containers for rapid, low-risk production releases. **Key Responsibilities & Core Duties** **1.

Hands-On Code Remediation & Dependency Patching** Write, refactor, and review application code to directly remediate static code analysis (SAST) findings (e.g., SQL/command injection, cross-site scripting, insecure deserialization, improper error handling, weak cryptography).

Resolve complex third-party library and framework upgrades (SCA/CVE remediation), managing transitive dependency conflicts, breaking API changes, and version incompatibilities across Java, Python, Go, .NET, or Java

Script/Type

Script stacks.

Implement targeted automated unit, integration, and regression tests to validate that code fixes and patched libraries do not introduce functional regressions. **2.

Containerization & Same-Day Release Enablement** Work directly in application repositories to write and optimize **Dockerfile** s, container manifests, and base image configurations (Docker, OCI, Kubernetes/Open

Shift).

Assist application squads in containerizing non-containerized legacy services, establishing minimal base images and automated base-image rebuild triggers for same-day OS/runtime patching.

Help configure and fine-tune CI/CD build scripts and release pipelines to compress deployment cycle times and eliminate manual deployment steps for emergency hotfixes. **3.

Application Plan Technical Validation** Perform code-level reviews of proposed remediation plans from application teams, verifying whether proposed library version bumps or refactored logic effectively eliminate the root cause of the vulnerability.

Identify technical prerequisites (e.g., test coverage gaps, build tool upgrades, compiler/runtime updates) needed before a team can successfully patch and release. **4.

Contractor Squad Pairing & PR Review** Act as a peer reviewer and technical guide for external contractor engineers assigned to assist with remediation work.

Review contractor-submitted pull requests (PRs) for code cleanliness, security correctness, test coverage, and enterprise architectural standards.

Facilitate smooth technical onboarding and repository access for contractor developers. **5.

Internal Tooling Adoption & Developer Feedback** Actively pilot, adopt,



and demonstrate internal developer tools, IDE security plugins, automated PR bots (e.g., Dependabot/Renovate patterns), and local scanning utilities within engineering squads.

Troubleshoot false positives, scanner configuration errors, and build pipeline failures; provide direct, actionable feedback to internal platform and tooling teams to improve developer experience. **Required Qualifications & Experience** **Education & Experience Requirements** **Bachelor's Degree** in Computer Science, Software Engineering, Information Systems, or related technical field. **4–7 years** of hands-on software development and engineering experience delivering enterprise web applications, microservices, or distributed backend systems.

Proven track record of directly fixing static code vulnerabilities (SAST) and managing third-party dependency/package upgrades in production environments.

Practical, hands-on experience containerizing applications and working with container orchestration platforms (Docker, Kubernetes, Open

Shift). **Technical Proficiencies** **Core Programming Languages:** Solid, hands-on development proficiency in at least one or two primary enterprise languages: **Java (Spring Boot), Python, Go, C#/.NET, or Type

Script/Node.js** . **Static Code Analysis (SAST):** Ability to analyze and fix scanner findings from tools such as **Sonar

Qube, Checkmarx, Veracode, or Fortify** . **Dependency & Package Management:** Practical experience with dependency resolution and build tools: **Maven, Gradle, npm/yarn, NuGet, pip/Poetry, or Go modules** , alongside SCA tools like **Snyk, Black Duck, or JFrog Xray** . **Containers & Runtime:** Hands-on experience creating production-grade **Dockerfile** s, managing multi-stage builds, patching container base images, and deploying to **Kubernetes or Open

Shift** . **CI/CD & Version Control:** Proficient with **Git** , branching strategies (Gitflow/trunk-based), and pipeline configurations (e.g., Jenkins, Git

Hub Actions, Tekton, Git

Lab CI, Harness). **Core Competencies & Working Style** **Competency** **Behavioral Expectation** **Hands-On Craftsmanship** Loves writing code, debugging builds, untangling messy dependency trees, and seeing clean PRs merged to production. **Developer-to-Developer Empathy** Speaks the language of squad engineers, troubleshoots shoulder-to-shoulder, and offers practical solutions rather than abstract advice. **Pragmatic Problem Solver** Able to quickly find safe workarounds or code refactors when direct library upgrades introduce breaking API changes. **Clear Communication** Explains the "why" and "how" of security fixes clearly in PR comments, documentation, and pairing sessions.



**Key Performance Indicators (Success Metrics)** **Direct Remediation Output:** Number of validated PRs merged and critical/high vulnerabilities (SAST & SCA) successfully resolved across assigned services. **Same-Day Hotfix Readiness:** Number of application components successfully containerized and equipped with automated verification pipelines capable of same-day hotfix releases. **Turnaround Time for Technical Reviews:** Fast, reliable review turnaround for application remediation plans and contractor pull requests. **Build & Release Optimization:** Measurable reduction in build and deployment friction for patched releases within supported application squads. ------------------------------------------------------ **Job Family Group:** Technology ------------------------------------------------------ **Job Family:** Applications Development ------------------------------------------------------ **Time Type:** Full time ------------------------------------------------------ **Primary Location Full Time Salary Range:** $111,600.00 - $161,600.00 ------------------------------------------------------ **Most Relevant Skills** Please see the requirements listed above. ------------------------------------------------------ **Other Relevant Skills** For complementary skills, please see above and/or contact the recruiter. ------------------------------------------------------ **Automated Processing and AI** We use automated processing, including artificial intelligence, for our legitimate business interests (or our reasonable and appropriate business purposes) to identify and align the candidate's skills and abilities with a specific job opening.

Additionally, if you so choose, or consent, we can match your skills and abilities to other suitable roles at Citi.

Importantly, all our hiring processes and decisions, including determining your suitability for a role, are conducted, checked, and decided by individuals.

Our automated processing and AI do not involve relying on automatic or autonomous decision-making.

Please refer to any Jurisdictional Considerations, with specific provisions for your country (where relevant) for further details. ------------------------------------------------------ _This job opening is for an existing job vacancy._ ------------------------------------------------------ _Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law._ _If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review_ _Accessibility at Citi (https://www.citigroup.com/citi/accessibility/application-accessibility.htm)_ _._ _View Citi's_ _EEO Policy Statement (https://www.citigroup.com/global/eeo-aa-policy)_ _and the_ _Know Your Rights (https://www.eeoc.gov/sites/default/files/2023-06/22-088_EEOC_Know

Your

Rights6.12Screen

Rdr.pdf)_ _poster._ Citi is an equal opportunity and affirmative action employer.

Minority/Female/Veteran/Individuals with Disabilities/Sexual Orientation/Gender Identity.

📌 Senior Software Engineer Technical Remediation & Enablement (Mississauga)
🏢 Citigroup
📍 Mississauga