Senior API Security Engineer | Cloud & DevOps (Hybrid)

American express; Phoenix (AZ); Remote; USD 28,929 - 39,950; Full time

Benefits offered by this job

Health insurance

Retirement plan match

Paid parental leave

Flexible work options

Job summary

American Express is seeking a Senior API Security Designer to lead API security initiatives and drive risk reduction across enterprise services. You will collaborate with DevOps teams and product groups to embed secure design and testing practices, shaping standards and driving secure SDLC adoption.

The role emphasizes hands-on security leadership, API governance, and the ability to evangelize security controls across large-scale digital programs.

Qualifications

• Four-year degree in software engineering, information security or related field.
• 2+ years in API security, secure design and development practices.
• 2+ years building and securing web APIs and apps: REST and gRPC.
• 2+ years security testing of web services and APIs.
• 2+ years risk modeling for applications and services.
• 2+ years with OAuth 2.0, OIDC, JWT.
• 6+ years with standards like NIST 800-53, NIST CSF, OWASP, SANS Top 25.

Responsibilities

• Perform ongoing administration and ensure API owners meet risk-based requirements.
• Create and maintain API security standards and design patterns.
• Validate API security controls against vulnerability test results for audibility.
• Act as API security technical consultant to application teams.
• Advocate API security policy standards.
• Be recognized as an API security expert within the organization.

Skills

API security

DevOps liaison

Independent worker

Team collaboration

Communication skills

Security mindset

Critical thinking

Problem solving

Security governance

Leadership

Education

Bachelor's degree in software engineering or information security

Tools

REST

gRPC

Job description

American Express is seeking a Senior API Security Designer to lead API security initiatives and drive risk reduction across enterprise services. You will collaborate with DevOps teams and product groups to embed secure design and testing practices, shaping standards and driving secure SDLC adoption.

The role emphasizes hands-on security leadership, API governance, and the ability to evangelize security controls across large-scale digital programs.