Senior AppSec Research Lead

American Express; Phoenix (AZ); On-site; USD 180,000 - 240,000; Full time

Job summary

American Express is seeking a highly technical Senior Manager of Application Security Research to advance vulnerability discovery and threat analysis across applications, APIs, AI/ML, and emerging tech. You will lead security research, mentor staff, and collaborate with SOC and engineering teams to protect the enterprise.

The role requires hands-on expertise in reverse engineering, secure code review, and incident response, with a focus on translating findings into actionable security

Qualifications

• Bachelor's degree in CS, IS, cyber or equivalent; advanced degree preferred.
• Knowledge of regulatory compliance and security standards.
• Experience in cybersecurity operations and application security.
• Experience with SCA/SAST/DAST/MAST/API security.
• Experience with cloud security and threat intelligence.

Responsibilities

• Monitor application security systems for threats and vulnerabilities.
• Manage app security platforms and ensure robust protection.
• Lead adoption of new security tech and best practices within the team.
• Oversee vulnerability management and remediation prioritization.
• Develop and maintain security policies, standards and procedures.
• Collaborate with product and business teams to align tech initiatives with business goals.

Skills

Regulatory compliance

Cybersecurity operations

AI-enabled security

Vulnerability research

Secure code review

Education

Bachelor's degree in Computer Science / Cybersecurity

Tools

Nessus

Qualys

Rapid7

Burp Suite

Wireshark

Metasploit

Job description

American Express is seeking a highly technical Senior Manager of Application Security Research to advance vulnerability discovery and threat analysis across applications, APIs, AI/ML, and emerging tech. You will lead security research, mentor staff, and collaborate with SOC and engineering teams to protect the enterprise.

The role requires hands-on expertise in reverse engineering, secure code review, and incident response, with a focus on translating findings into actionable security