Sr. Application Security Engineer

Amex GBT is a place where colleagues find inspiration in travel as a force for good and – through their work – can make an impact on our industry. We’re here to help our colleagues achieve success and offer an inclusive and collaborative culture where your voice is valued.

What You'll Do

• Partner with DevOps teams to architect and maintain secure CI/CD pipelines that embed security testing throughout the software development lifecycle, ensuring security is built in from the start.
• Deploy and fine-tune automated security tools including SAST, DAST, SCA, and container scanning, with centralized reporting and aggregation of findings across the organization.
• Deploy and manage API security tools while ensuring cloud-native security best practices across IAM, network security, encryption, secrets management, and compliance frameworks.
• Collaborate with development teams to establish and reinforce secure coding standards, provide hands-on security guidance, and champion a security-first culture across engineering.
• Evaluate and establish guardrails for the safe adoption of AI-assisted coding tools across engineering teams, identifying and mitigating risks such as hallucinated dependencies, injected vulnerabilities, and governance gaps.
• Maintain adherence to industry standards (PCI-DSS, GDPR, SOC 2) relevant to the travel industry, build KPI dashboards for application security initiatives, and communicate findings to leadership.
• Guide junior engineers in security best practices, foster a security-conscious engineering culture, and contribute to the evolution of the organization's security posture.

What We're Looking For

• 5+ years of professional software development with demonstrated mastery in at least one major programming language (Python, Go, Java, JavaScript/TypeScript, or equivalent)
• 3+ years of hands-on application security or DevSecOps experience
• Deep expertise in OWASP Top 10, secure coding practices, and API security
• Strong cloud security knowledge with hands-on experience in AWS, Azure, or GCP
• Proficiency with CI/CD tools (Jenkins, GitLab CI/CD, GitHub Actions, CircleCI, Azure DevOps) and infrastructure-as-code technologies (Terraform, Docker, Kubernetes)
• Advanced understanding of cloud-native security, including IAM, network security, encryption, and secrets management
• Practical experience with security tools (SAST/DAST scanners, WAF solutions, SIEM platforms, vulnerability scanners)
• Familiarity with agentic AI programming tools (GitHub Copilot, Cursor, Claude Code) and AI-specific security tooling
• Experience evaluating and securing agentic AI coding tools with understanding of associated risks (hallucinated dependencies, code injection, governance gaps)
• Ability to design and implement guardrails and detection strategies for safe AI tool adoption