Application Security Penetration Engineer

Citi is seeking an Application Security Penetration Engineer for its Offensive Security team in Irving, TX. The role focuses on deep-dive vulnerability assessments and penetration testing across web applications, mobile, thick clients, APIs, microservices, and GenAI or LLM implementations, with clear risk communication and remediation guidance.

Key Responsibilities

• Perform manual vulnerability assessments and penetration testing across applications and/or infrastructure.
• Identify and validate security vulnerabilities across Citi applications, APIs, cloud-native services, and AI/ML architectures.
• Develop functional proof-of-concept code and exploit scenarios to demonstrate exploitability and impact.
• Research and apply LLM-based security testing harnesses to uncover deeply embedded, non-obvious vulnerabilities.
• Detect multi-step business logic abuse chains, cryptographic weaknesses, and complex privilege escalation paths that can evade manual and traditional automated testing.
• Document vulnerabilities with reproduction steps, attack chains, and risk ratings in standardized assessment reports.
• Present vulnerability assessment results to both technical and non-technical audiences.
• Explain vulnerabilities to application developers, system architects, and ML engineers, including root cause analysis and business risk.
• Support remediation efforts by outlining a defense-in-depth approach to business stakeholders.
• Propose actionable mitigating controls, code-level remediation solutions, and AI safety guardrails to close security gaps.
• Stay current on emerging offensive security techniques and participate in threat modeling and adversarial testing across traditional and AI-driven stacks.
• Support penetration testing engagements for the firm’s critical, top-tier applications.
• Research and help automate pentest activities, including use of AI or LLM tooling, to identify vulnerabilities more effectively.

Required Qualifications

• Minimum of 1 to 3 years of hands-on experience in penetration testing, application security assessment, or software development, ideally in an enterprise environment.
• Hands-on experience with dynamic or proxy or network testing tools including Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, or OWASP ZAP.
• Hands-on experience with static analysis and software composition tools including Checkmarx, BlackDuck, SonarQube, or Snyk.
• Exposure to AI security or adversarial testing tools such as Garak, PyRIT, Counterfit, or the Adversarial Robustness Toolbox (ART) is advantageous.
• Strong foundation in enterprise programming and scripting languages including Python, Java, .NET/C#, C/C++, Ruby, and/or NodeJS.
• Familiarity with common web and application framework stacks such as Spring, AngularJS, React, Struts, and ASP.NET Core, or AI orchestration libraries.
• Deep knowledge of application architectures and enterprise infrastructure including databases, middleware, web servers, and cloud computing (GCP, AWS, Azure) supporting microservices and containerized workloads.
• Deep knowledge of common industry security standards including OWASP Top 10 and CWE/SANS Top 25.
• Working familiarity with emerging AI security standards including OWASP Top 10 for LLMs, MITRE ATLAS, and NIST AI RMF.

Tools and Technologies

• Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP, OWASP ZAP
• Checkmarx, BlackDuck, SonarQube, Snyk
• Garak, PyRIT, Counterfit, Adversarial Robustness Toolbox (ART)
• Python, Java, .NET/C#, C/C++, Ruby, NodeJS
• Spring, AngularJS, React, Struts, ASP.NET Core, OWASP Top 10
• CWE/SANS Top 25, OWASP Top 10 for LLMs, MITRE ATLAS, NIST AI RMF
• GCP, AWS, Azure

Compensation and Location

• Location: Irving, TX (onsite)
• Salary: USD 96,400 - 144,600 per year
• Time type: Full time
• Primary location: Irving Texas United States
• Primary location full time salary range: $96,400.00 - $144,600.00

Education and Certification

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related discipline. Equivalent professional or hands-on experience may be considered in lieu of a degree.
• Must have or be willing to obtain industry-accredited security certifications such as OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+, or CySA+.

Benefits

• Medical, dental & vision coverage
• 401(k)
• Life, accident, and disability insurance
• Wellness programs
• Paid time off packages including planned time off (vacation), unplanned time off (sick leave), and paid holidays

Posting Details

• Anticipated posting close date: Oct 20, 2026
• Job family group: Technology
• Job family: Information Security