Cloud Security Threat Modeler Senior Analyst at Citi

Warsaw, Masovian Voivodeship, Poland -

Full Time

Start Date

Immediate

Expiry Date

02 Mar, 26

Salary

0.0

Posted On

02 Dec, 25

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Threat Modeling, Cybersecurity, Jira, Scripting Languages, Infrastructure as Code, Threat Modeling Methodologies, Vulnerabilities Identification, Operating Systems, Cloud Platforms, Technical Architecture Design, Analytical Skills, Documentation, Communication Skills, Continuous Learning, Penetration Testing, Docker

Industry

Financial Services

Description

Perform Threat Modeling using a documented process Development of automation tools as required Maintain a high standard of work in identifying threats and specifying mitigating controls Attending to the lifecycle of identified threats and controls Delivery of threat models and supporting tasks within existing timeframes Provide feedback, support, and improvements to the existing threat modeling process Present work to seniors, the team, and other technical teams 5+ years of experience in a Cybersecurity role. Proven experience with Jira or other similar ticketing systems. Strong understanding of security best practices related to Authentication, Authorization, Logging/Monitoring, Encryption, Infrastructure Security, and Network Segmentation. Experience with scripting languages (e.g., Python, Bash, PowerShell) or Infrastructure as Code tools (e.g., Terraform, CloudFormation). Familiarity with threat modeling methodologies like STRIDE, PASTA, Attack Trees, and the MITRE ATT&CK framework, as well as threat modeling tools (e.g., IriusRisk, ThreatModeler, Microsoft Threat Modeling Tool). Ability to identify vulnerabilities using CWE or OWASP frameworks. Working knowledge of Operating Systems (e.g., Windows, Linux) and their hardening best practices. Familiarity with Development Concepts such as CI/CD pipelines, and SDLC. Working knowledge of Cloud Platforms (e.g., AWS, Azure, GCP). Ability to design and review technical architectures. Strong analytical skills, diligence, and attention to detail. Excellent skills in creating and maintaining high-quality documentation. Demonstrated ability to work effectively with diverse individuals and teams. Excellent written and verbal communication skills. A passion for continuous learning and staying up-to-date with new technologies and methodologies. Proven ability to build relationships across multiple cross-functional teams. 3+ years experience specifically focused on Threat Modeling. Experience with Docker, Kubernetes, Serverless Technologies (e.g., AWS Lambda, Azure Functions, Google Cloud Functions), and Helm. Familiarity with Cloud Development Kit (CDK) and GitOps principles. Experience supporting or performing Penetration Testing activities (e.g., vulnerability scanning, network penetration testing, web application testing, mobile application testing). Experience with Snowflake, MongoDB, Terraform Cloud, GitHub, or Databricks. Experience working in a regulated environment (e.g., financial services). Ability to think like an attacker and anticipate potential threats. While certifications are not strictly required, possessing one or more of the following certifications is highly desirable: Bachelor's degree in Computer related field or equivalent work experience ------------------------------------------------------ For complementary skills, please see above and/or contact the recruiter. ------------------------------------------------------ AWS Certified Cloud Practitioner AWS Certified Solutions Architect - Associate Google Cloud Certified Professional Cloud Architect Microsoft Certified: Azure Solutions Architect Expert Microsoft Certified: Azure Administrator Associate CompTIA Cloud+ CompTIA Security+ (ISC)² Certified in Cybersecurity GIAC Security Essentials Certification (GSEC) ISACA CSX Cybersecurity Fundamentals Certificate

Responsibilities

The Cloud Security Threat Modeler Senior Analyst will perform threat modeling and develop automation tools as required. They will maintain high standards in identifying threats and specifying mitigating controls while delivering threat models within existing timeframes.