Senior Network Security Engineer

Citi is looking for a Senior Network Security Engineer to architect and operate the full-packet capture infrastructure that powers enterprise threat detection across our global network perimeter. Specifically, we are looking for strong Python developers with a solid understanding of network packet capturing who can build resilient automation, APIs, and data pipelines around enterprise capture fabrics.

In this role, you will build and own the capture layer that security operations and forensic response teams rely on to investigate sophisticated threats at scale. You will sit within the Perimeter Reliability Engineering team, working at the intersection of network visibility, security forensics, and platform automation.

Responsibilities

• Develop production-grade Python automation for PCAP archival pipelines, Arkime API integrations, telemetry extraction, and event-driven packet extraction workflows.
• Architect and own full-packet capture infrastructure across Citi’s global network perimeter, including TAP aggregation fabrics, out-of-band offload networks, and high-throughput NVMe and ZFS storage.
• Deploy, tune, and scale Arkime capture platforms at enterprise level, covering capture daemon configuration, BPF filter design, and OpenSearch index lifecycle management.
• Build hardware-accelerated packet capture solutions using SmartNICs and kernel-bypass frameworks such as DPDK, PF_RING ZC, and AF_XDP to sustain high-throughput capture without packet loss.
• Operate and extend Zeek to extract deep protocol metadata and integrate findings into SIEM and threat intelligence platforms.
• Lead forensic investigations into complex network security incidents using Wireshark, tshark, and tcpdump to reconstruct attack timelines and session activity.
• Integrate packet capture platforms with AI and machine learning threat detection pipelines, including TLS fingerprinting and alert-to-packet correlation workflows.
• Build Grafana dashboards and alerting pipelines with Prometheus and InfluxDB to monitor capture rates, packet loss, storage consumption, and cluster health.

Required Qualifications & Skills

• Strong Python software development experience (object-oriented design, async workflows, data processing, and API integrations) applied to PCAP lifecycle automation, Arkime API scripting, and OpenSearch query pipelines.
• Solid understanding of packet capturing concepts and mechanics, including raw socket capture, packet sniffing, BPF filters, pcap header structures, and network flow analysis.
• Seven or more years of experience in infrastructure or network security engineering, including three to four years focused on packet capture, network forensics, or network visibility.
• Expert-level experience deploying and operating Arkime, including capture daemon tuning and multi-site OpenSearch cluster architecture.
• Hands-on experience designing packet capture infrastructure, including TAP, SPAN, and ERSPAN architectures, aggregation fabrics, and NVMe and ZFS storage tiering.
• Protocol analysis skills using Wireshark, tshark, and tcpdump, including advanced filter construction and full session reconstruction.
• System-level Linux performance tuning experience, including kernel parameter configuration, NUMA topology awareness, CPU pinning, and NIC queue optimization.
• Bachelor’s degree in a relevant field or equivalent practical experience, with a Master’s degree preferred.

Beneficial Skills & Qualifications

• Experience building custom packet parsing tools, PCAP inspection utilities, or network automation frameworks in Python (e.g., Scapy, PyShark, dpkt, socket programming).
• Experience with kernel-bypass and SmartNIC capture technologies, including DPDK, PF_RING ZC, and AF_XDP.
• Zeek deployment and custom script development for protocol analysis and security data enrichment.
• Ansible experience for configuration management and infrastructure-as-code deployment of capture environments.
• Knowledge of machine learning-based network anomaly detection and flow-level feature engineering for security use cases.
• Active contribution to open-source packet capture projects such as Arkime, Zeek, or Suricata.

What we can offer you

By joining Citi Hungary, you will not only be part of a business casual workplace with a hybrid working model (up to 2 days working at home per week), but also receive a competitive compensation package and enjoy a whole host of additional benefits that support you (and your family) to be well, live well and save well:

• Cafeteria Program
• Home Office Allowance (for colleagues working in hybrid work models)
• Paid Parental Leave Program (maternity and paternity leave)
• Private Medical Care Program and onsite medical rooms at our offices
• Pension Plan Contribution to voluntary pension fund
• Group Life Insurance
• Employee Assistance Program
• Access to a wide variety of learning and development programs, online course libraries and upskilling platforms, such as Udemy and Degreed
• Flexible work arrangements to support you in managing work - life balance
• Career progression opportunities across geographies and business lines
• Socially active employee communities with diverse networking opportunities

Alongside these benefits Citi is committed to ensuring our workplace is where everyone feels comfortable coming to work as their whole self every day. We want the best talent around the world to be energized to join us, motivated to stay, and empowered to thrive.

Primary Location Full Time Salary Range:

17 157 800,00 Ft - 28 767 800,00 Ft

Working at Citi is far more than just a job. A career with us means joining a team of more than 230,000 dedicated people from around the globe. At Citi, you'll have the opportunity to grow your career, give back to your community and make a real impact.

Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.