Sr. Application Security Architect (AI & API)

Preferred qualities

Location

• United Kingdom
• The #TeamGBT Experience
• Work and life: Find your happy medium at Amex GBT.
• Flexible benefits are tailored to each country and start the day you do. These include health and welfare insurance plans, retirement programs, parental leave, adoption assistance, and wellbeing resources to support you and your immediate family.
• Travel perks: get a choice of deals each week from major travel providers on everything from flights to hotels to cruises and car rentals.
• Develop the skills you want when the time is right for you, with access to over 20,000 courses on our learning platform, leadership courses, and new job openings available to internal candidates first.
• We strive to champion Inclusion in every aspect of our business at Amex GBT. You can connect with colleagues through our global INclusion Groups, centered around common identities or initiatives, to discuss challenges, obstacles, achievements, and drive company awareness and action.
• And much more!
• All applicants will receive equal consideration for employment without regard to age, sex, gender (and characteristics related to sex and gender), pregnancy (and related medical conditions), race, color, citizenship, religion, disability, or any other class or characteristic protected by law.
• Click Here for Additional Disclosures in Accordance with the LA County Fair Chance Ordinance.
• Furthermore, we are committed to providing reasonable accommodation to qualified individuals with disabilities. Please let your recruiter know if you need an accommodation at any point during the hiring process. For details regarding how we protect your data, please consult the Amex GBT Recruitment Privacy Statement.
• What if I don’t meet every requirement? If you’re passionate about our mission and believe you’d be a phenomenal addition to our team, don’t worry about “checking every box;" please apply anyway. You may be exactly the person we’re looking for!

Qualifications

• 10+ years of experience in software engineering, application security, or security architecture, including experience guiding or reviewing both application and API architecture decisions at scale.
• Strong foundation in application security fundamentals — secure SDLC, vulnerability management (SAST/DAST/SCA), secure coding practices, and OWASP Top 10 — in addition to deep API- and AI-specific expertise.
• Deep expertise in API design and security, including OAuth 2.0, OpenID Connect, JWT/JOSE, and API gateway/service mesh architectures.
• Strong ability to evaluate and clearly communicate architectural tradeoffs, translating complex technical decisions into guidance that development teams can act on.
• Experience assessing and securing existing application, API, and AI implementations, including working with API gateways and/or AI gateways.
• Hands-on experience with cloud-native architectures (AWS, Azure, or GCP) and container orchestration (Kubernetes).
• Practical experience with AI-native and agentic development tools (e.g., Claude Code, GitHub Copilot, Cursor, or similar) and a clear understanding of the security implications of AI-assisted and autonomous development workflows.
• Strong background in applied cryptography and secure software design.
• Proven ability to lead threat modeling, secure design reviews, and architecture governance for both traditional applications and AI/API-centric systems across cross-functional engineering organizations.
• Proficiency in multiple programming languages (e.g., Go, Java, Python).
• Excellent written and verbal communication skills, including experience developing technical policy, standards, or training materials.
• Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent practical experience.
• Advanced degree (M.Sc./Ph.D.) in Computer Science, Artificial Intelligence, or a related field.
• Track record of thought leadership: publications, conference talks, published CVEs, or contributions to security/API standards bodies (e.g., IETF OAuth/JOSE working groups).
• Experience with regulatory or compliance frameworks such as PCI-DSS.
• Experience securing AI/LLM-powered systems and agentic architectures, including AI gateway deployments.
• Background in broader application security program leadership (e.g., vulnerability management, secure SDLC rollout) beyond API- and AI-specific initiatives.
• Experience leading or mentoring engineering teams in a principal/staff-level individual contributor or architect capacity.
• Location
• United Kingdom
• The #TeamGBT Experience
• Work and life: Find your happy medium at Amex GBT.
• Flexible benefits are tailored to each country and start the day you do. These include health and welfare insurance plans, retirement programs, parental leave, adoption assistance, and wellbeing resources to support you and your immediate family.
• Travel perks: get a choice of deals each week from major travel providers on everything from flights to hotels to cruises and car rentals.
• Develop the skills you want when the time is right for you, with access to over 20,000 courses on our learning platform, leadership courses, and new job openings available to internal candidates first.
• We strive to champion Inclusion in every aspect of our business at Amex GBT. You can connect with colleagues through our global INclusion Groups, centered around common identities or initiatives, to discuss challenges, obstacles, achievements, and drive company awareness and action.
• And much more!
• All applicants will receive equal consideration for employment without regard to age, sex, gender (and characteristics related to sex and gender), pregnancy (and related medical conditions), race, color, citizenship, religion, disability, or any other class or characteristic protected by law.
• Click Here for Additional Disclosures in Accordance with the LA County Fair Chance Ordinance.
• Furthermore, we are committed to providing reasonable accommodation to qualified individuals with disabilities. Please let your recruiter know if you need an accommodation at any point during the hiring process. For details regarding how we protect your data, please consult the Amex GBT Recruitment Privacy Statement.
• What if I don’t meet every requirement? If you’re passionate about our mission and believe you’d be a phenomenal addition to our team, don’t worry about “checking every box;" please apply anyway. You may be exactly the person we’re looking for!

Preferred Qualifications

• Preferred qualities