Technical Change Lead

The Technical Change Lead is a hands-on, high-impact technical leader responsible for actively driving software vulnerability remediation across designated application portfolios. This role works directly at the engineering squad and application level to help teams remediate static code vulnerabilities (SAST), patch vulnerable third-party dependencies and frameworks (SCA), and adopt modern software delivery practices - including containerization and lightweight release mechanics - to achieve same-day hotfix and deployment capabilities .

Operating on the ground as a technical catalyst and problem solver, the Technical Change Lead partners with application leads to validate remediation plans, coordinates day-to-day execution with external contractor remediation squads, and works alongside internal tooling teams to eliminate developer friction and accelerate patching velocity.

What you’ll do

Hands-On Remediation Enablement & Same-Day Release Acceleration

• •Work directly with software application teams to assess their release pipelines, identify deployment bottlenecks, and implement lightweight release patterns that enable same-day patching of critical security defects.
• •Guide and coach development squads on modernizing legacy packaging and transitioning workloads into containerized runtimes (e.g., Docker, Kubernetes, OpenShift), reducing patch blast radius and enabling rapid, repeatable deployments.
• •Lead practical, technical workshops and hands-on coding/pairing sessions demonstrating how to refactor insecure code patterns and safely upgrade complex dependencies with zero downtime.

Application Plan Review & Technical Feasibility Validation

• •Review, critique, and validate vulnerability remediation plans submitted by application teams, ensuring proposals address fundamental code defects and dependency debt rather than temporary workarounds.
• •Evaluate technical trade-offs involving breaking API changes in patched libraries, major framework upgrades, and compiler/runtime compatibility.
• •Assist application architects in breaking down large remediation initiatives into sprint-sized, testable increments with automated regression validation.

Contractor Squad Coordination & Delivery Tracking

• •Coordinate day-to-day technical workflows for specialized external contractor squads and staff augmentation engineers assigned to assist application teams with code fixes and dependency updates.
• •Review contractor code submissions and pull requests for adherence to enterprise code quality, testing standards, and security requirements.
• •Track contractor burn-down rates, triage throughput, and verify that knowledge transfer to permanent application owners occurs seamlessly during the remediation lifecycle.

Internal Tooling Adoption & Developer Experience Optimization

• •Champion the adoption of developer-centric scanning and remediation tools directly inside engineering workflows (IDE extensions, automated dependency bump bots, localized static analysis, image scanning).
• •Gather concrete feedback from developer teams regarding scanning false positives, build breaks, or pipeline delays; partner with internal tooling and developer platform teams to refine scanner configurations and deploy self-service remediation utilities.
• •Assist in rolling out centralized vulnerability tracking portals, SBOM management tools, and fast-track change approval pathways for vulnerability patches.

Tactical Program Governance & Remediation Tracking

• •Monitor and report on portfolio-level remediation health, tracking Mean Time to Remediate (MTTR) , Static Code Defect Resolution Velocity , Dependency Patch Aging , and Same-Day Fix Readiness .
• •Escalate systemic technical roadblocks, recurring architectural patterns causing vulnerabilities, and infrastructure gaps to the Program Director and relevant platform owners.
• •Ensure all completed remediations possess sufficient automated testing and deployment evidence to satisfy internal audit and risk compliance criteria.

What we’ll need from you

• •Education & Professional Experience
• •Bachelor’s Degree in Computer Science, Software Engineering, Information Technology, or related technical field (Master’s degree is a plus).
• •7–15 years of progressive experience in software engineering, application architecture, or technical delivery leadership.
• •3–5+ years in a lead engineer, technical architect, or technical lead role guiding engineering squads, driving code quality improvements, or managing technical debt / software remediation initiatives.
• •Demonstrated hands-on experience refactoring software to resolve static code defects (SAST) and managing complex third-party library/framework upgrades across multi-tier applications.
• •Experience collaborating with and directing external contractors, vendor delivery teams, or distributed engineering resources.

• •Technical Proficiencies
• •Static Code Analysis & Refactoring: Practical experience interpreting SAST findings (e.g., SonarQube, Checkmarx, Veracode, Fortify) and implementing secure coding patterns in languages such as Java, Python, Go, C#/.NET, or JavaScript/TypeScript.
• •Software Dependency Management: Deep familiarity with Software Composition Analysis (SCA) tools (e.g., Snyk, Black Duck, JFrog Xray, Dependabot) and dependency management ecosystems (Maven, Gradle, npm, NuGet, pip).
• •Containerization & Cloud-Native Delivery: Hands-on proficiency with container technologies (Docker, OCI), container management platforms (Kubernetes, OpenShift), and container base-image patching strategies.
• •Build Automation & Rapid Release: Experience optimizing CI/CD build pipelines (e.g., Jenkins, Tekton, Harness, GitHub Actions), automated test execution, and deployment strategies (canary, blue-green) to facilitate hotfixes and same-day releases.

• •Core Competencies
• •Technical Depth & Credibility : Able to read code, review PRs, and engage peer-to-peer with lead developers and architects to solve real technical blockers.
• •Hands-On Problem Solver: Proactively jumps into tricky dependency graphs or pipeline issues to help teams find practical paths to resolution.
• •Empathy & Collaboration: Understands sprint pressures and developer workflows; focuses on streamlining processes and removing toil rather than enforcing rigid bureaucracy.
• •Clear Communication: Translates complex technical challenges and remediation progress into crisp updates for directors and program managers.
• •Execution Focus: Driven by measurable outcomes - closing defect counts, reducing patch dwell time, and helping teams achieve same-day deployment capabilities.

• •Key Performance Indicators (Success Metrics)
• •Same-Day Deployment Enablement: Number of assigned application services enabled with containerized pipelines and automated verification to release vulnerability fixes within 24 hours.
• •Static Code Remediation Volume: Rate of closed static code (SAST) defects and reduction in high/critical code flaws across the assigned portfolio.
• •Third-Party Dependency MTTR: Reduction in the average dwell time of vulnerable open-source and third-party libraries across active repositories.
• •Plan Validation Accuracy & Velocity: Turnaround time and execution success rate for application remediation plans reviewed and approved.
• •Contractor Utilization & Quality: Quality scores and defect-resolution output delivered by external contractor squads under supervision.

What we can offer you

We work hard to have a positive financial and social impact on the communities we serve. In turn, we put our employees first and provide the best-in-class benefits they need to be well, live well and save well.

By joining Citi London, you will not only be part of a business casual workplace with a hybrid working model (up to 2 days working at home per week), but also receive a competitive base salary (which is annually reviewed), and enjoy a whole host of additional benefits such as:

Generous holiday allowance starting at 27 days plus ba