American Express is a global financial services company operating across banking, finance, and B2B payments. Its business includes consumer, business, and corporate credit cards; payment and merchant services; savings accounts, certificates of deposit, and personal loans; as well as rewards, travel programs, corporate payment solutions, financial education, security services, and cardmember and merchant support.
Senior Application Security Engineer – Security Tooling | American Express | Phoenix Hybrid
Build AI-enabled application security tooling and secure SDLC practices for American Express financial services. Integrate security testing and automation across applications, APIs, cloud, containers, and CI/CD environments.
United States
Arizona$103,750 – $174,750 / year
HybridFull-timeMiddleSeniorEnglish RequiredSoftware EngineerDescription
- Design, build, test, and troubleshoot software applications and systems
- Deliver software builds using standardized practices, shared tools, reusable components, and clear documentation
- Conduct code reviews, secure code reviews, and automated tests
- Support and monitor software in test, integration, and production environments
- Apply security and regulatory standards to maintain software compliance
- Partner with product and business teams to connect technology initiatives with business goals
- Create and maintain security policies, procedures, and recommended practices
- Embed security throughout the SDLC with code reviews and secure-coding guidance
- Deploy encryption controls to protect sensitive data in transit and at rest
- Investigate emerging security threats, technologies, and disruptive developments
- Evaluate new cybersecurity technologies within SDLC and release-management processes
- Prepare technical documentation and reports covering assessments, findings, and remediation
- Use AI-enabled security tooling and automation to strengthen threat detection, investigation efficiency, and operational visibility
- Establish security controls and monitoring for AI-enabled applications and workflows
- Develop and improve prompts for AI-agent cybersecurity engineering and identify opportunities for agentic AI workflows
Requirements
- Bachelor’s degree in computer science, information systems, cybersecurity, or a related field, or comparable experience; an advanced degree is preferred
- Understanding of regulatory compliance requirements and security standards
- Knowledge of application development and security practices
- Knowledge of data engineering principles
- Knowledge of cloud security management
- Knowledge of data privacy and protection, including DPP and GDPR
- Knowledge of data security management
- Experience with Python, Bash, PowerShell, or similar scripting languages for security-task automation
- Understanding of distributed multi-tier systems, algorithms, NoSQL databases, and relational databases
- Familiarity with core tools for planning, analyzing, designing, building, testing, configuring, and maintaining assigned applications
- Knowledge of event-driven architecture and messaging, including Kafka, webhooks, and asynchronous API design, is preferred
- Experience designing applications, developing software, and implementing automated tests
- Experience with object-oriented design and development across multiple programming languages
- Experience with distributed multi-tier systems, algorithms, and relational databases
- Experience applying Agile methods such as Scrum or Kanban, iterative delivery, and user stories
- Experience with test automation and documentation, including automated, functional, and performance testing
- Experience using unit-testing and regression-testing frameworks
- Experience with Java 8 or later and the Spring Suite Framework is preferred
- Experience with Python and Django is preferred
- Experience with React JS, Node JS, and Go is preferred
- Experience with Kubernetes, Docker, Jenkins, and cloud deployment or CI/CD is preferred
- Experience with PostgreSQL, Oracle, or comparable relational databases is preferred
- Knowledge of AI security topics, including generative AI risks, model integrity, prompt security, and protection of sensitive enterprise data
- Knowledge of AI-assisted cybersecurity operations and automation frameworks
- At least one security certification is preferred, such as CSSLP, GWEB, GCIH, CEH, GSEC, C|ASE, or CCNA
- At least one developer certification is preferred, such as OCP, OCA, OCM, DCD, DVA-C02, CKAD, ACE, CCSP, or Professional Cloud Developer
- Eligibility to work for American Express in the United States is required; visa sponsorship will not be pursued
Benefits
- Bonus
- Benefits