Senior Cloud-Native Application Security Engineer

American Express Global Business Travel; Helena (MT); On-site; USD 104,000 - 194,000; Full time

Job summary

Amex GBT seeks an experienced Senior Application Security Engineer to join our remote-enabled team in the United States. You will design and maintain secure CI/CD pipelines, implement automated security testing, and govern secure AI coding tool usage.

You will collaborate with DevOps and development teams to enforce secure coding practices and drive security initiatives across cloud-native infrastructure. The role requires deep security expertise, strong development background, and the ability

Qualifications

• 5+ years of professional software development experience with demonstrable expertise in major programming languages (Python, Go, Java, JavaScript/TypeScript)
• 3+ years of hands-on application security or DevSecOps experience
• Strong knowledge of OWASP Top 10 and related secure coding practices; deep understanding of API security, authentication protocols, and secure API design
• Strong cloud security expertise with at least one major cloud service provider (AWS, Azure, or GCP); deep understanding of cloud-native security including IAM, network security, encryption, secrets management, and compliance frameworks
• Proficiency with CI/CD tools and practical experience with infrastructure-as-code, containerization, and orchestration technologies; strong understanding of network security
• Experience with agentic AI programming and governance; ability to mitigate AI-specific security threats
• Experience with threat modeling methodologies and risk assessment
• Knowledge of PCI-DSS, GDPR, and CCPA; governance frameworks for AI tooling
• Background in penetration testing or red team operations; MLSecOps knowledge
• Professional security certifications and multi-cloud experience across AWS, Azure, and GCP
• Experience in travel, hospitality, or e-commerce; open-source contributions or security publications

Responsibilities

• Work with DevOps teams to design, implement, and maintain secure CI/CD pipelines with integrated security testing
• Implement and tune automated security scanning (SAST, DAST, SCA, container scanning)
• Deploy and support API security tools and report findings to a central aggregator
• Collaborate with development teams to promote secure coding practices and provide security guidance
• Evaluate and govern secure use of agentic AI coding tools and establish guardrails
• Ensure compliance with PCI-DSS, GDPR, and SOC 2
• Build KPI and metrics reporting for application security initiatives
• Mentor junior engineers and promote a security-first culture across teams

Skills

Python

Go

Java

JavaScript/TypeScript

DevSecOps

OWASP Top 10

Cloud security

CI/CD

AI tooling security

Penetration testing

Tools

SAST/DAST scanners

WAF

SIEM

Vulnerability scanners

Secrets management

Terraform

Docker

Kubernetes

Git/GitHub

CI/CD tools

Job description

Amex GBT seeks an experienced Senior Application Security Engineer to join our remote-enabled team in the United States. You will design and maintain secure CI/CD pipelines, implement automated security testing, and govern secure AI coding tool usage.

You will collaborate with DevOps and development teams to enforce secure coding practices and drive security initiatives across cloud-native infrastructure. The role requires deep security expertise, strong development background, and the ability