Principal AI Identity Architect

American Express Global Business Travel; Olympia (WA); On-site; USD 104,000 - 194,000; Full time

Benefits offered by this job

Flexible benefits

Travel perks

Learning platform access

Inclusion initiatives

Job summary

Amex GBT seeks a Principal IAM AI Engineer to design and operate identity security for AI agents and human users. You will shape scalable access for AI workloads, drive machine identity governance, and embed identity controls across the AI development lifecycle.

Lead a technical team, implement policy-driven authorization, and ensure compliance with risk and audit requirements while collaborating with security, risk, and engineering peers.

Qualifications

• Proven experience designing identity, access, and governance for non-human identities.
• Strong AWS and cloud identity skills including IAM design and least-privilege.
• Mastery of OAuth, OIDC, SAML, SCIM, JWT, and mTLS across multi-cloud environments.
• Ability to architect enterprise-scale identity security programs and ownership of service accounts.

Responsibilities

• Deploy and automate identity controls at runtime across enterprise environments.
• Govern machine identities and agent lifecycles, including credential rotation and reviews.
• Build credential workflows for AI workloads with automated secret cycling.
• Define fine-grained access models and policy declarations via infra-as-code.
• Collaborate with AI/application teams to embed identity requirements in design.
• Lead a team delivering identity security capabilities and roadmap.

Skills

PAM

Okta IdP

IGA platforms Saviynt

OAuth / OIDC / SAML

JWT / mTLS

AWS IAM design

least-privilege at scale

Tools

CyberArk

HashiCorp Vault

Okta

Saviynt

Kubernetes

Job description

Amex GBT seeks a Principal IAM AI Engineer to design and operate identity security for AI agents and human users. You will shape scalable access for AI workloads, drive machine identity governance, and embed identity controls across the AI development lifecycle.

Lead a technical team, implement policy-driven authorization, and ensure compliance with risk and audit requirements while collaborating with security, risk, and engineering peers.