Senior Cloud Security Engineer & DevSecOps Lead

American Express Global Business Travel; Dover (DE); On-site; USD 104,000 - 194,000; Full time

Benefits offered by this job

Flexible benefits

Travel perks

Learning platform access

Inclusion groups

Job summary

Amex GBT is seeking a Senior Application Security Engineer to join our remote team. You will blend development and security expertise to secure our cloud-native infrastructure and mentor others across engineering teams.

You’ll design secure CI/CD pipelines, implement automated scanning, govern AI coding tools, and ensure PCI-DSS, GDPR, and SOC 2 compliance while delivering KPI-driven security metrics to leadership.

Qualifications

• 5+ years of professional software development with major languages.
• 3+ years in application security or DevSecOps.
• Knowledge of OWASP Top 10 and API security.

Responsibilities

• Design, implement, and maintain secure CI/CD pipelines with security testing.
• Tune automated security scanning (SAST/DAST/SCA) and container scanning.
• Deploy and support API security tools and central reporting.
• Promote secure coding practices across development teams.
• Govern AI coding tools usage with guardrails and risk mitigation.
• Ensure PCI-DSS, GDPR, SOC 2 compliance.
• Build KPI reporting and present security findings to leadership.
• Mentor junior engineers and foster a security-first culture.

Skills

Programming languages

Security

Cloud security

CI/CD

IaC

Containerization

Agentic AI tools

Threat modeling

Compliance

Security certifications

Red team/pen-testing

DevSecOps

Tools

SAST/DAST scanners

WAF

SIEM

Vulnerability scanners

Secrets management

Terraform

Docker

Kubernetes

CI/CD tooling

Job description

Amex GBT is seeking a Senior Application Security Engineer to join our remote team. You will blend development and security expertise to secure our cloud-native infrastructure and mentor others across engineering teams.

You’ll design secure CI/CD pipelines, implement automated scanning, govern AI coding tools, and ensure PCI-DSS, GDPR, and SOC 2 compliance while delivering KPI-driven security metrics to leadership.