Senior Application Security Architect (AI & API)

About the role

Amex GBT is looking for a Senior Application Security Architect specializing in AI and API security. The role helps development teams make sound architectural choices and build secure software, covering the full spectrum of application security: secure SDLC, vulnerability management and secure coding. It focuses on APIs and AI/agentic systems and acts as a trusted technical advisor across engineering.

Key responsibilities

• Guide engineering teams in choosing application, API and AI/agentic architecture patterns, explaining tradeoffs (e.g., REST vs. GraphQL vs. gRPC, synchronous vs. event-driven).
• Advise teams on the security, scalability and maintainability of design choices.
• Help implement and secure chosen architectures, including authentication, authorization (OAuth 2.0, OpenID Connect, JOSE/JWT) and API/AI gateway configuration.
• Assess and secure existing applications, APIs and AI implementations using SAST/DAST/SCA, API gateways and AI gateways.
• Lead threat modeling and secure design reviews, including risks specific to LLM-powered and autonomous components (prompt injection, data exfiltration, model misuse).
• Define governance policies and standards with engineering, security, legal and product leadership, and represent the company in industry standards work.
• Mentor engineers in applied cryptography, secure coding, secure API design and cloud-native architecture (Kubernetes, AWS/GCP/Azure).
• Develop decision frameworks, tradeoff guides and documentation, and report security KPIs and metrics to senior leadership.

Required profile

• 10+ years of experience in software engineering, application security or security architecture, including guiding or reviewing application and API architecture at scale.
• Bachelor's degree in Computer Science, Engineering or a related field, or equivalent practical experience.
• Proven ability to lead threat modeling, secure design reviews and architecture governance across cross-functional engineering teams.
• Preferred: advanced degree, track record of thought leadership (publications, CVEs, standards contributions), regulatory/compliance experience (e.g. PCI-DSS), and experience mentoring engineering teams at principal/architect level.

Required skills

• API and AI security, including OAuth 2.0, OpenID Connect, JWT/JOSE and API gateway/service mesh architectures.
• Cloud-native architectures (AWS, Azure or GCP) and Kubernetes.
• Applied cryptography and secure software design.
• Proficiency in several programming languages (e.g. Go, Java, Python).
• Experience with AI-native development tools (e.g. Claude Code, GitHub Copilot, Cursor) and their security implications.

What we offer

• Flexible benefits tailored to each country, including health and welfare insurance, retirement programs, parental leave and adoption assistance.
• Weekly travel deals from major providers.
• Access to over 20,000 courses and leadership courses, with internal candidates first for new openings.