Senior Network Forensics & Packet Capture Engineer

Discover your future at Citi

Working at Citi is far more than just a job. A career with us means joining a team of approximately 219,000 dedicated people from around the globe. At Citi, you’ll have the opportunity to grow your career, give back to your community and make a real impact.

Job Overview

Citi's Perimeter Reliability Engineering team is seeking a Senior Network Forensics & Packet Capture Engineer to architect, deploy, and operate high-performance full-packet capture infrastructure across Citi's global network perimeter. This is a senior engineering role at the intersection of network visibility, security forensics, and platform automation — building and owning the capture layer that powers enterprise threat detection, SOC investigations, and forensic response. Your work will directly shape the infrastructure that global security teams rely on to detect and investigate sophisticated threats at scale.

Responsibilities

• Design and own end-to-end full-packet capture infrastructure across global sites, encompassing TAP aggregation fabrics, out-of-band offload networks, high-throughput NVMe/ZFS storage, and OpenSearch indexing clusters.
• Deploy, tune, and scale Arkime at enterprise level, including capture daemon configuration, BPF filter hierarchies, OpenSearch Index Lifecycle Management, and Viewer customization tailored to SOC analyst workflows.
• Engineer hardware-accelerated packet capture solutions using SmartNICs, kernel-bypass frameworks including DPDK, PF_RING ZC, and AF_XDP, and TAP aggregation platforms to sustain high-throughput capture without packet loss.
• Build and maintain production-grade Python automation for PCAP archival pipelines, Arkime REST API integrations, OpenSearch lifecycle management, and event-driven packet extraction workflows.
• Operate and extend Zeek for deep protocol metadata extraction, develop custom Zeek scripts, and integrate output into SIEM and threat intelligence platforms.
• Lead forensic root cause analysis for complex network security incidents, applying , Wireshark, tshark, tcpdump, and session logs to reconstruct attack timelines and session activity.
• Integrate PCAP platforms with AI and machine learning threat detection pipelines, including JA3/JA3S TLS fingerprinting and alert-to-packet correlation workflows, to accelerate detection and investigation.
• Develop Grafana dashboards and alerting pipelines using Prometheus and InfluxDB to provide real-time visibility into capture rates, packet drops, storage consumption, and cluster health.

Required Qualifications & Skills

• 7 or more years in infrastructure or network security engineering, including a minimum of 3 to 4 years in dedicated packet capture, network forensics, or network visibility roles.
• Expert-level Arkime deployment and operations, including capture daemon tuning, multi-site OpenSearch cluster architecture, and large-scale platform scaling.
• Hands-on packet capture infrastructure engineering covering TAP, SPAN, and ERSPAN design, aggregation fabric architecture, out-of-band network design, and storage tiering with NVMe and ZFS.
• Proficiency in Python, applied specifically to PCAP lifecycle automation, Arkime API scripting, OpenSearch query pipelines, and infrastructure tooling development.
• Expert-level protocol analysis using Wireshark, tshark, and tcpdump, including advanced filter construction and full session reconstruction.
• Linux performance tuning at the system level, including kernel parameter configuration, NUMA topology awareness, CPU pinning, and NIC queue optimization.
• Bachelor's degree in a relevant field or equivalent practical experience; a Master's degree is preferred.

Beneficial Skills & Qualifications

• Hands-on experience with kernel-bypass and SmartNIC capture technologies, including DPDK, PF_RING ZC, AF_XDP
• Zeek deployment, configuration, and custom script development for protocol analysis and security data enrichment.
• Ansible for configuration management and infrastructure-as-code deployment of capture environments.
• Applied knowledge of machine learning-based network anomaly detection and flow-level feature engineering for security use cases.
• Active open-source contribution to open-source packet capture projects such as Arkime, Zeek, or Suricata.

What We Offer

At Citi, you will work within a high-performance global security engineering team, tackling some of the most technically complex infrastructure challenges in financial services. This role offers real ownership, technical depth, and the opportunity to build systems that operate at global scale and directly support the security of one of the world's largest financial institutions.

By joining Citi Hungary, you will not only be part of a business casual workplace with a hybrid working model (up to 2 days working at home per week), but also receive a competitive compensation package and enjoy a whole host of additional benefits that support you (and your family) to be well, live well and save well:

• Cafeteria Program
• Home Office Allowance (for colleagues working in hybrid work models)
• Paid Parental Leave Program (maternity and paternity leave)
• Private Medical Care Program and onsite medical rooms at our offices
• Pension Plan Contribution to voluntary pension fund
• Group Life Insurance
• Employee Assistance Program
• Access to a wide variety of learning and development programs, online course libraries and upskilling platforms, such as Udemy and Degreed
• Flexible work arrangements to support you in managing work - life balance
• Career progression opportunities across geographies and business lines
• Socially active employee communities with diverse networking opportunities

• undefined

Build the infrastructure that keeps one of the world's largest financial institutions secure — apply now to join Citi's Perimeter Reliability Engineering team as a Senior Network Forensics & Packet Capture Engineer.

Alongside these benefits Citi is committed to ensuring our workplace is where everyone feels comfortable coming to work as their whole self every day. We want the best talent around the world to be energized to join us, motivated to stay, and empowered to thrive. 

Sounds like Citi has everything you need?

Then apply to discover the true extent of your capabilities. 

#LI-AE1

------------------------------------------------------

Job Family Group:

------------------------------------------------------

Job Family:

------------------------------------------------------

Time Type:

------------------------------------------------------

Primary Location Full Time Salary Range:

------------------------------------------------------

Most Relevant Skills

------------------------------------------------------

Other Relevant Skills

------------------------------------------------------

Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.

If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.

View Citi’s EEO Policy Statement and the Know Your Rights poster.