Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
3 Intel Signals
How they approach application security
Citi emphasizes "shifting left"and automated testing in the software lifecycle.
Citi leaders have publicly framed supply chain security and secure ingestion of OSS as AppSec priorities, exemplified by the Continuous Secure Software Ingestion (CSSI) project.
The team
Jonathan Meadows leads cloud security and application security functions at Citi.
Roberto Armenteros is listed as "Head of Vulnerability Assessments, AppSec and Cloud SecOps".
Job postings indicate AppSec responsibilities include resolving vulnerabilities and automating security controls.
James Holland and other AppSec practitioners are involved in supply chain and application security work.
What they're working on
Citi has contributed tooling and processes for software supply chain security by donating a security kit to OpenSSF.
The Continuous Secure Software Ingestion (CSSI) project, presented by James Holland, is a "policy driven system built on Tekton & Open Policy Agent (OPA)"to automate OSS ingestion checks.
Citi also participates in panels and webinars discussing supply chain security and automated testing practices.
Job descriptions highlight operational practices like supporting teams to resolve vulnerabilities and identifying automation opportunities.
