Sr. Application Security Architect (AI & API)

Amex GBT is a place where colleagues find inspiration in travel as a force for good and – through their work – can make an impact on our industry. We’re here to help our colleagues achieve success and offer an inclusive and collaborative culture where your voice is valued.

We're looking for a Senior Application Security Architect with a deep specialization in AI and API security to help Amex GBT's development teams make sound architectural choices and build secure software. This role covers the full spectrum of application security — secure SDLC, vulnerability management, and secure coding practices — with a particular focus on the APIs and AI/agentic systems that are increasingly central to our platform. Rather than designing architectures in isolation, you'll guide engineering teams toward the right approach for their use case, educate them on the tradeoffs between options, and work hands-on to help implement and secure what they build. You'll also assess and strengthen the security of our existing application, API, and AI implementations, using tooling such as API and AI gateways, and act as a trusted technical advisor across engineering.

What you'll be doing:

• Serve as a senior application security architect for Amex GBT's engineering organization, with a primary focus on API and AI/agentic systems while maintaining broad ownership of secure SDLC and application security practices.
• Guide engineering teams in selecting the right application, API, and AI/agentic architecture patterns for their use case, clearly explaining the tradeoffs between approaches (e.g., REST vs. GraphQL vs. gRPC, synchronous vs. event-driven, different AI/agent frameworks).
• Educate and advise development teams on the security, scalability, and maintainability implications of different application, API, and AI/agentic design choices.
• Partner hands-on with development teams to implement and secure chosen application, API, and AI architectures, including authentication, authorization (OAuth 2.0, OpenID Connect, JOSE/JWT), and API/AI gateway configuration.
• Assess and secure existing application, API, and AI implementations, using appropriate tooling (such as SAST/DAST/SCA, API gateways, and AI gateways) to identify and close security gaps.
• Guide the secure adoption of AI-native and agentic development workflows (e.g., AI-assisted IDEs, agentic coding platforms) across engineering, balancing productivity gains with security and governance.
• Lead threat modeling and secure design reviews across applications, APIs, AI/ML services, and agentic systems, identifying risks specific to LLM-powered and autonomous components (e.g., prompt injection, data exfiltration, model misuse).
• Partner with engineering, security, legal, and product leadership to define governance policies and standards for application design, API design, and responsible AI/agentic tool usage.
• Provide technical leadership and mentorship on applied cryptography, secure coding, secure API design, and cloud-native architecture (Kubernetes, AWS/GCP/Azure).
• Represent Amex GBT in industry standards efforts related to application and API security and AI governance (e.g., OAuth, JOSE, emerging AI/agent security standards).
• Develop and maintain decision frameworks, tradeoff guides, and documentation to help teams evaluate and secure their application, API, and AI architecture choices.
• Generate security KPI and metrics reporting across security programs to measure progress and effectiveness, and present findings to senior leadership.

What we're looking for:

• 10+ years of experience in software engineering, application security, or security architecture, including experience guiding or reviewing both application and API architecture decisions at scale.
• Strong foundation in application security fundamentals — secure SDLC, vulnerability management (SAST/DAST/SCA), secure coding practices, and OWASP Top 10 — in addition to deep API- and AI-specific expertise.
• Deep expertise in API design and security, including OAuth 2.0, OpenID Connect, JWT/JOSE, and API gateway/service mesh architectures.
• Strong ability to evaluate and clearly communicate architectural tradeoffs, translating complex technical decisions into guidance that development teams can act on.
• Experience assessing and securing existing application, API, and AI implementations, including working with API gateways and/or AI gateways.
• Hands-on experience with cloud-native architectures (AWS, Azure, or GCP) and container orchestration (Kubernetes).
• Practical experience with AI-native and agentic development tools (e.g., Claude Code, GitHub Copilot, Cursor, or similar) and a clear understanding of the security implications of AI-assisted and autonomous development workflows.
• Strong background in applied cryptography and secure software design.
• Proven ability to lead threat modeling, secure design reviews, and architecture governance for both traditional applications and AI/API-centric systems across cross-functional engineering organizations.
• Proficiency in multiple programming languages (e.g., Go, Java, Python).
• Excellent written and verbal communication skills, including experience developing technical policy, standards, or training materials.
• Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent practical experience.

Preferred qualities

• Advanced degree (M.Sc./Ph.D.) in Computer Science, Artificial Intelligence, or a related field.
• Track record of thought leadership: publications, conference talks, published CVEs, or contributions to security/API standards bodies (e.g., IETF OAuth/JOSE working groups).
• Experience with regulatory or compliance frameworks such as PCI-DSS.
• Experience securing AI/LLM-powered systems and agentic architectures, including AI gateway deployments.
• Background in broader application security program leadership (e.g., vulnerability management, secure SDLC rollout) beyond API- and AI-specific initiatives.
• Experience leading or mentoring engineering teams in a principal/staff-level individual contributor or architect capacity.

Location

United Kingdom

The #TeamGBT Experience

Work and life: Find your happy medium at Amex GBT.

• Flexible benefits are tailored to each country and start the day you do. These include health and welfare insurance plans, retirement programs, parental leave, adoption assistance, and wellbeing resources to support you and your immediate family.

• Travel perks: get a choice of deals each week from major travel providers on everything from flights to hotels to cruises and car rentals.

• Develop the skills you want when the time is right for you, with access to over 20,000 courses on our learning platform, leadership courses, and new job openings available to internal candidates first.

• We strive to champion Inclusion in every aspect of our business at Amex GBT. You can connect with colleagues through our global INclusion Groups, centered around common identities or initiatives, to discuss challenges, obstacles, achievements, and drive company awareness and action.

• And much more!

All applicants will receive equal consideration for employment without regard to age, sex, gender (and characteristics related to sex and gender), pregnancy (and related medical conditions), race, color, citizenship, religion, disability, or any other class or characteristic protected by law.

Click Here for Additional Disclosures in Accordance with the LA County Fair Chance Ordinance.

Furthermore, we are committed to providing reasonable accommodation to qualified individuals with disabilities. Please let your recruiter know if you need an accommodation at any point during the hiring process. For details regarding how we protect your data, please consult the Amex GBT Recruitment Privacy Statement.

What if I don’t meet every requirement? If you’re passionate about our mission and believe you’d be a phenomenal addition to our team, don’t worry about “checking every box;" please apply anyway. You may be exactly the person we’re looking for!