Cyber Security Architect

American Express Global Business Travel; United States; On-site; USD 104,000 - 194,000; Full time

Benefits offered by this job

Travel perks

Comprehensive learning platform access

Inclusion Groups and supportive perks

Job summary

Amex GBT seeks a Cyber Security Architect to embed security into design and build processes across cloud, data, and applications. You will review architectures, model threats, and translate risks into actionable design patterns while ensuring compliance with PCI, GDPR, ISO 27001 and other standards.

You’ll lead secure integration patterns, guide API security, and champion privacy‑by‑design while collaborating with security and engineering teams to deliver secure traveler experiences.

Qualifications

• 8+ years in cybersecurity with architecture/security engineering focus
• Experience designing/reviewing cloud architectures (AWS/Azure/GCP)
• Strong knowledge of application, network, and IAM security including least-privilege/zero-trust
• Experience applying threat modeling to design changes
• Familiarity with PCI DSS, GDPR, ISO 27001
• Bachelor’s degree or equivalent; relevant certifications such as CISSP/SABSA/TOGAF/CCSP/Microsoft Cloud certs
• Experience supporting due diligence for M&A or vendor integrations
• DevSecOps and CI/CD security; AI/ML security considerations

Responsibilities

• Secure solution design and architecture review
• Review designs for new products and major changes using threat modeling to find risks and gaps
• Turn findings into actionable recommendations balancing risk, cost and delivery timelines
• Own the review process and produce reference architectures and reusable patterns
• Define secure integration patterns for fast supplier onboarding
• Guide secure API/microservices design including authentication/authorization/rate limiting
• Assess AI/ML implementations for prompt injection and data leakage
• Define guardrails for AI agents including scoped permissions and audit trails
• Align architecture decisions with frameworks (NIST, ISO, PCI, GDPR, SOC 2)
• Mentor engineers and junior architects on secure design

Skills

Security architecture

Cloud security

Threat modeling

Risk communication

Identity & access management

DevSecOps

AI/ML security

Security governance

Security design reviews

Education

Bachelor’s degree or equivalent

Security certifications (CISSP/SABSA/TOGAF/CCSP)

Job description

Amex GBT is a place where colleagues find inspiration in travel as a force for good and – through their work – can make an impact on our industry. We’re here to help our colleagues achieve success and offer an inclusive and collaborative culture where your voice is valued. We're looking for a Cyber Security Architect to embed security into how we design and build technology — not add it after the fact.

What You'll Do

• Secure solution design and architecture review


• Review designs for new products, platforms, and major changes using structured threat modeling (e.g., STRIDE) to find risks, gaps, and single points of failure


• Turn findings into actionable recommendations that balance risk, cost, and delivery timelines


• Own the review process, define “secure enough” at each design stage, and produce reference architectures and reusable patterns


• Cloud, application, and data security architecture


• Set standards for cloud environments (AWS, Azure, GCP), including segmentation, workload isolation, IAM (least-privilege, zero-trust), encryption, and secrets management


• Guide secure API and microservices design, including authentication, authorization, and rate limiting


• Protect traveler and payment data across its lifecycle (including PCI DSS flows), championing privacy‑by‑design and data minimization with Privacy and Data Security Investigations teams


• Third‑party and supplier risk


• Assess integrations with airlines, hotels, GDSs (Sabre, Amadeus, Travelport), payment processors, and other travel suppliers


• Support technical due diligence for new vendors, partnerships, and acquisitions


• Define secure integration patterns for fast supplier onboarding without compromising standards


• AI Security Architecture Review


• AI/ML implementations (traveler assistants, copilots, automation) before launch, assessing risks like prompt injection, output data leakage, and over‑permissioned agents


• Define guardrails and agentic AI patterns, including scoped permissions, approval workflows, audit trails, AI‑specific logging and monitoring, and revocation of misbehaving agents


• Set standards for model provenance and versioning, vet third‑party model providers, and define when human review is required before launch


• Identity Security Architecture


• Define identity standards for AI agents and non‑human accounts, including unique agent identities, least‑privilege access, and credential lifecycle management


• Assess risks specific to AI agents authenticating or acting on behalf of users, such as impersonation and token misuse


• Set authorization boundaries for AI agents involved in provisioning, deprovisioning, or access reviews


• Governance, standards, and influence


• Maintain and evolve security architecture standards, guardrails, and design principles, creating reusable frameworks that improve the quality and speed of engineering output across teams


• Align architecture decisions with frameworks and regulations (NIST CSF, ISO 27001, PCI DSS, GDPR, SOC 2) and translate technical risk and trade‑offs into terms that engineering, product, and executive stakeholders can act on


• Partner with the Cyber Defense team (CSIRT, CTI, Detection Engineering, Data Security Investigations) to feed incident lessons and threat intelligence into architecture decisions, and mentor engineers and junior architects on secure design

What We’re Looking For

• 8+ years in cybersecurity, with meaningful time spent in a security architecture or senior security engineering role


• Hands‑on experience designing or reviewing architecture for cloud‑based systems (AWS, Azure, or GCP)


• Strong grounding in application security, network security, and identity and access management, including least‑privilege and Zero Trust principles


• Experience applying threat modeling methodologies and translating findings into practical design changes


• Working knowledge of relevant regulations and standards, such as PCI DSS, GDPR, or ISO 27001


• Demonstrated ability to translate technical risk into terms non‑technical stakeholders can act on and to influence decisions without direct authority


• A bachelor's degree in a related field, or equivalent experience


• Preferred Relevant certifications such as CISSP, SABSA, TOGAF, CCSP, Microsoft Cybersecurity Architect Expert, or a cloud security specialty (Azure Security Engineer, AWS Security Specialty, Google Professional Cloud Security Engineer)


• Experience supporting technical due diligence for M&A or major vendor integrations


• Familiarity with DevSecOps and embedding security into CI/CD pipelines, plus security considerations for AI/ML systems (e.g., prompt injection, AI governance frameworks)


• Skills and competencies Sound judgment to weigh risk against business speed and land on a clear recommendation, not just flag problems


• Comfort working at both whiteboard design and deep technical levels, with clear written and verbal communication for audiences from engineers to executives


• Ability to build trust and influence teams outside your reporting line, while evaluating emerging technologies (AI‑assisted booking, new payment rails) and recommending the strongest path to a future‑state security architecture

Location

United States

Salary

The US national base salary range for this position is from $104,300.00 - $193,700.00 The national range provided includes the base salary that Amex GBT expects to pay for the role. Actual base salary will be based on factors including the scope and complexity of the role and the successful candidate’s relevant experience, skills, knowledge, and work location. In addition to base salary, the anticipated range of which is posted above, this role is eligible for a discretionary annual bonus, which rewards participants based on company and individual performance. For information about our comprehensive US benefits programs and eligibility, please review our Benefits‑at‑a‑Glance document.

Benefits at a glance

Benefits at a glance The #TeamGBT Experience Work and life: Find your happy medium at Amex GBT. Flexible benefits are tailored to each country and start the day you do. These include health and welfare insurance plans, retirement programs, parental leave, adoption assistance, and wellbeing resources to support you and your immediate family. Travel perks: get a choice of deals each week from major travel providers on everything from flights to hotels to cruises and car rentals. Develop the skills you want when the time is right for you, with access to over 20,000 courses on our learning platform, leadership courses, and new job openings available to internal candidates first. We strive to champion Inclusion in every aspect of our business at Amex GBT. You can connect with colleagues through our global INclusion Groups, centered around common identities or initiatives, to discuss challenges, obstacles, achievements, and drive company awareness and action. And much more!

All applicants will receive equal consideration for employment without regard to age, sex, gender (and characteristics related to sex and gender), pregnancy (and related medical conditions), race, color, citizenship, religion, disability, or any other class or characteristic protected by law.

Furthermore, we are committed to providing reasonable accommodation to qualified individuals with disabilities. Please let your recruiter know if you need an accommodation at any point during the hiring process.

For details regarding how we protect your data, please consult the Amex GBT Recruitment Privacy Statement.