This role pays more than
62%
of similar roles. Most pay
$151,000–$214,500
— the shaded band above.
At the midpoint, this role pays about
$195k
versus about
$183k
for comparable roles.
Based on 240 similar postings.
Employer
About Citi
Citi is one of the world’s most trusted financial institutions, proudly serving millions of customers across the United States.
Citi currently has
271 open roles
on FindRole.
Listed pay typically runs
$125,760–$188,640
across 255 roles with salary data.
The Threat & Exposure Management Platform Engineer will design, build, and operate the core data platform and architecture that unifies threat, vulnerability, and exposure signals across the enterprise. This role involves developing scalable data pipelines to ingest and normalize information from various security tools like EDR/XDR, CSPM, and threat intelligence feeds. The engineer will architect correlation logic, manage data schemas, and build robust API integrations to create a unified view of risk. Key responsibilities include integrating adversary-informed validation results into the platform and ensuring high availability for production pipelines. Required skills include proficiency in Python, Go, or Java; experience with Kafka, Spark, Airflow, or Flink; and expertise in cloud-native infrastructure across AWS, Azure, or GCP. The role solves the complex problem of automating risk prioritization by consolidating disparate security data into a single, actionable substrate.
Design, build, and operate scalable data pipelines to ingest and normalize threat and exposure signals from various security platforms.
Develop and maintain robust API integrations to connect security tools, data lakes, and analytics engines into a unified view.
Architect correlation logic and data models that link vulnerabilities, threats, assets, and business context for risk prioritization.
Build and manage the underlying data substrate including schemas, storage layers, and streaming infrastructure as the source of truth.
Develop secure, well-documented APIs to allow downstream systems and analyst tools to consume unified threat data programmatically.
Integrate adversary emulation and control validation results into the correlation engine to provide evidence of exploitability.
Establish common taxonomies and data standards to reconcile inconsistent formats across heterogeneous security tools.
Ensure production pipelines maintain high availability, performance, and data quality through monitoring and self-healing mechanisms.
What we're looking for
Bachelor's degree or equivalent experience required; Master's degree preferred.
Proven track record of owning and operating complex, production-grade security data platforms end-to-end.
Experience building large-scale batch and streaming data pipelines using tools like Kafka, Spark, Airflow, or Flink.
Proficiency in at least one major programming language such as Python, Go, or Java.
Expertise in API design and development (REST/GraphQL) including authentication, rate limiting, and versioning.
Experience integrating heterogeneous security platforms including vulnerability management, EDR/XDR, CSPM, SIEM, and threat intelligence.
Proficiency with cloud-native data infrastructure (AWS/Azure/GCP), relational/NoSQL databases, and software engineering fundamentals like CI/CD and IaC.
10+ years of experience leading a continuous exposure management program or initiative end-to-end (preferred); relevant certifications (preferred).
SAP S/4HANA
SAP GRC
Segregation of Duties (SoD)
Vulnerability Management
SAP Joule
SAP Business AI
SAP Fiori
SailPoint
SSO
MFA
PAM
PIM
Zero Trust
Cybersecurity
Audit
Security Architecture