Cloud Network Security Engineer (AWS/GCP)

American Express; Phoenix (AZ); On-site; USD 140,000 - 180,000; Full time

Job summary

American Express seeks a Public Cloud Network Security Engineer to design, secure, and automate network security across AWS (primarily) with GCP support. You will implement native cloud security controls, Palo Alto technologies, IaC with Terraform, and policy-driven guardrails that scale across cloud environments.

Strong automation, CI/CD, and AI-enabled security workflows are valued. The role emphasizes collaboration with cloud, platform, application, and security teams to embed secure

Qualifications

• Hands-on experience securing public cloud environments, with strong AWS expertise and working knowledge of GCP.
• Strong understanding of network security fundamentals, including routing, segmentation, firewalls, DNS, TLS, VPNs, private connectivity, ingress/egress controls, and traffic inspection.
• Experience with AWS-native network security services and controls; familiarity with equivalent GCP capabilities is preferred.
• Experience deploying or managing Palo Alto technologies in cloud or hybrid environments.
• Proficiency with Terraform and infrastructure-as-code design patterns.
• Experience using GitHub, GitHub Actions, and modern CI/CD pipelines for infrastructure or security automation.
• Familiarity with policy-as-code tools and concepts, such as automated compliance checks, guardrails, and pre-deployment validation.
• Ability to write clear technical documentation, reusable standards, and operational runbooks.
• Understanding of secure software delivery practices, secrets handling, least privilege, and automated testing.
• Foundational knowledge of generative AI, agentic AI, prompt engineering, model risks, AI-assisted engineering workflows, and responsible AI use in security contexts.

Responsibilities

• Design, implement, and maintain network security architectures across AWS and GCP cloud environments.
• Configure and manage native CSP network security controls, including security groups, NACLs, firewalls, routing controls, private connectivity, segmentation, inspection, and logging capabilities.
• Deploy, integrate, and operate Palo Alto cloud network security platforms and related controls.
• Build and maintain reusable Terraform modules for secure cloud networking and security infrastructure.
• Use GitHub and GitHub Actions to support automated testing, validation, deployment, and lifecycle management of infrastructure and security controls.
• Promote CI/CD best practices, including code review, branch protection, automated checks, secrets management, environment promotion, and rollback strategies.
• Implement policy-as-code and infrastructure-as-code practices to enforce cloud security standards, compliance requirements, and architectural guardrails.
• Partner with cloud, platform, application, and security teams to embed secure networking patterns into standard engineering workflows.
• Develop automation to improve visibility, reduce manual operations, and accelerate secure cloud adoption.
• Evaluate and apply generative AI and agentic AI concepts to improve security engineering productivity, detection workflows, documentation, and operational decision support.

Skills

Network security fundamentals

AWS expertise

GCP knowledge

Terraform

Palo Alto cloud security

GitHub Actions

CI/CD pipelines

Automation

AI in security

Tools

Palo Alto cloud security platforms

GitHub

GitHub Actions

Terraform (IaC design patterns)

Job description

American Express seeks a Public Cloud Network Security Engineer to design, secure, and automate network security across AWS (primarily) with GCP support. You will implement native cloud security controls, Palo Alto technologies, IaC with Terraform, and policy-driven guardrails that scale across cloud environments.

Strong automation, CI/CD, and AI-enabled security workflows are valued. The role emphasizes collaboration with cloud, platform, application, and security teams to embed secure