SENIOR THREAT MODELER

Roles & Responsibilities

• Threat Modeling using a documented process.
• Development of automation tools as required.
• Maintain a high standard of work in identifying threats and specifying mitigating controls.
• Attending to the lifecycle of identified threats and controls.
• Delivery of threat models and supporting tasks within existing timeframes.
• Provide feedback, support, and improvements to the existing threat modeling process.
• Present work to seniors, the team, and other technical teams.
• Work with little supervision to complete work.
• Develop, test, and deploy secure and efficient Python-based applications, adhering to established SDLC processes and quality standards.

Technical Skills

• Two to five years of experience in several of the following:
• Minimum of six years of IT experience, with at least four years in Cybersecurity/Information Security.
• Demonstrated experience with Threat Modeling techniques such as STRIDE, PASTA, Attack trees, and tooling, including ATT&CK.
• Experience working in a cybersecurity role.
• Security practices related to authentication, authorization, logging/monitoring, encryption, infrastructure security, network/segmentation.
• Scripting languages, Infrastructure as Code (Terraform, CloudFormation).
• Jira or other ticketing systems.
• Design and review technical architectures.
• Strong proficiency in Programming Languages, with a preference for Python (asynchronous programming) and FastAPI (must have).
• Unit Testing: Developing and executing unit tests using frameworks like Pytest to ensure code quality (must have).
• Ensure all software platforms adhere to Citi's security standards and Software Development Life Cycle (SDLC) processes (must have).
• Identifying vulnerabilities using CWE or OWASP.
• Understanding of operating systems and their hardening.
• Development concepts (such as: CICD, Pipelines, SDLC).
• Cloud Development Kit (CDK), GitOps.
• Operating in a DevOps / agile team structure.
• Understanding of Docker/K8S/serverless/helm.
• Support or perform pen testing.
• Snowflake/MongoDB/Terraform Cloud/GitHub/Databricks.
• Karat Assessment (Python focus) is required for consideration.