Senior Manager - Application Security Research

Joining Amex Tech means discovering and shaping your contribution to something big. Here, you can work alongside talented tech teams and build a unique career with the Powerful Backing of American Express. With a range of opportunities to work with the latest technologies, and a commitment to back the broader engineering community through open source, our mission is to power your success. Because Amex Tech is powered by our technology, our culture, and our colleagues.

The Technology organization enables and accelerates the company’s growth strategies, delivering global capabilities and services in support of Amex’s customers and colleagues, while maintaining 24/7 servicing and availability to ensure an uninterrupted, high-quality customer experience. Technology provides the foundation for everything we do in the company while driving differentiation through building and leveraging innovative technology and data insights.

At American Express, our mission is to deliver the world’s best customer experience every day. At the heart of this mission is our Information Security organization, enabling exceptional experiences built on a foundation of trust, service, and security. We leverage advanced technologies and data-driven insights to stay ahead of an evolving threat landscape. We foster a culture of passion, curiosity, and courage—empowering you to innovate, grow, and help shape the future of a Fortune 100 company.

Trust. Service. Security.

American Express is seeking a highly technical and innovative Senior Manager of Application Security Research to help advance our application security research, vulnerability discovery, and threat analysis capabilities.

Reporting to the Director of Application Security, this role will lead and actively contribute to advanced security research focused on identifying, analyzing, and mitigating vulnerabilities across applications, software components, APIs, AI/ML, and emerging technologies.

The ideal candidate combines deep hands-on expertise in reverse engineering, vulnerability research, secure code review, and software engineering with the ability to translate technical discoveries into actionable security intelligence.

This position works closely with the American Express Fusion Center, Security Operations Center (SOC), Cyber Threat Intelligence, Incident Response, and engineering teams to identify emerging threats, develop indicators of compromise (IoCs), improve detection capabilities, and proactively protect American Express against sophisticated cyber threats.

This is a hands-on technical leadership position requiring strong research capabilities, engineering expertise, and the ability to investigate complex security challenges independently while guiding others.

- Bachelor's Degree in Computer Science, Information Systems, Cybersecurity, and/or comparable experience; advanced degree preferred
- Knowledge of regulatory compliance and security standards
- Knowledge of Identity & Access Management
- Knowledge of Security Architecture Management
- Knowledge of Security Governance and Operations
- Knowledge of Security Testing & Remediation
- Knowledge of Cloud Security Management
- Knowledge of Data Privacy & Protection (DPP, GDPR)
- Knowledge of AI-enabled cybersecurity operations platforms, automated threat detection techniques, and AI-assisted security analytics capabilities
- Understanding of AI security risks, responsible AI governance principles, and the operational implications of AI-enabled technologies within cybersecurity environments
- Experience in cybersecurity operations and application security
- Experience in Technical Writing and Documentation Development
- Experience with SCA/SAST/DAST/MAST/API Security
- Experience in network security, understanding of network security principles, including firewalls, VPNs, and network segmentation
- Experience in vulnerability scanning tools (e.g., Nessus, Qualys, Rapid7) and remediation processes
- Experience with penetration testing using industry-standard tools (e.g., Burp Suite, Wireshark, Metasploit, SQL map) for ongoing monitoring and compliance
- Experience in working on incident response efforts, including forensic analysis, malware analysis, and threat hunting
- Experience in securing cloud environments (e.g., AWS, Azure, Google Cloud) and implementing cloud security best practices
- Experience in regulatory requirements and standards (e.g., PCI-DSS, ISO 27001, NIST) and their application in cybersecurity operations
- Experience in Business Continuity Planning and Disaster Recovery
- At least one security related certification preferred like: GCPN, GWEB, GMOB, GOAA, GPEN, GWAT, GPEN, GXPN, GREM, CEH, C|ASE .NET, C|ASE Java, OSCP, OSWA, OSWE, CSSLP, other

Employment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.