Senior Security GRC Engineer — AI & Automation Innovator

American Express Global Business Travel; New York (NY); On-site; USD 104,000 - 194,000; Full time

Job summary

Amex GBT is seeking a Senior Security GRC Engineer to design, build, and scale automation and AI-driven solutions for governance, risk, and compliance. You will translate manual processes into automated, data-driven workflows at the intersection of security engineering and GRC.

Ideal candidates have hands-on engineering skills, a strong GRC foundation (NIST, ISO 27001, SOC 2), and experience applying AI/LLMs to real-world security use cases, delivering scalable automation.

Qualifications

• Bachelor's degree in computer science, information security, information systems, or a related field.
• 5+ years of experience in security engineering, GRC, or a related field.
• Strong programming/scripting skills and API/databases experience.
• Hands-on AI/ML experience, including LLMs, in business or security contexts.
• Knowledge of cybersecurity frameworks (NIST, ISO 27001, SOC 2) and compliance requirements.

Responsibilities

• Design, build, and maintain automation pipelines for evidence collection.
• Evaluate and deploy AI/LLM-based solutions to accelerate GRC workflows.
• Integrate GRC tooling with systems via APIs for automated data flows.
• Develop scripts, bots, and workflow tools to automate recurring GRC tasks.
• Collaborate with analysts and managers to re-engineer manual processes.
• Establish guardrails and quality controls for AI outputs.
• Monitor performance and risk posture of automation and AI tools.
• Stay current with AI and GRC technologies.
• Collaborate with other teams to align automation with security posture.

Skills

Python

JavaScript

APIs

GRC

Automation

AI/LLM

Security Engineering

Data analysis

Education

Bachelor's degree in computer science, information security, information systems, or related field

Tools

Onspring

Archer

MetricStream

Job description

Amex GBT is seeking a Senior Security GRC Engineer to design, build, and scale automation and AI-driven solutions for governance, risk, and compliance. You will translate manual processes into automated, data-driven workflows at the intersection of security engineering and GRC.

Ideal candidates have hands-on engineering skills, a strong GRC foundation (NIST, ISO 27001, SOC 2), and experience applying AI/LLMs to real-world security use cases, delivering scalable automation.