Cyber Security Architect

American Express Global Business Travel

4d•$104,300 - $193,700

About The Position

Amex GBT is hiring a Cyber Security Architect to embed security into the design and development of its technology. The role reviews proposed solutions and designs across the business, identifies risk early through threat modeling and architecture reviews, and provides actionable mitigation options. It works across engineering, risk management, and global travel technology, including booking platforms, payment flows, traveler data, and supplier integrations. The architect partners with product, engineering, and enterprise architecture teams from early design discussions; develops reusable security patterns and reference architectures; and serves as a technical authority on risk and delivery trade-offs. The position covers solution design, cloud, application, data, supplier, AI, and identity security, as well as security standards, regulatory alignment, incident-informed architecture, and mentoring. The role is based in the United States.

Requirements

At least 8 years of experience in cybersecurity, including meaningful experience in a security architecture or senior security engineering role.
Hands-on experience designing or reviewing architecture for cloud-based systems on AWS, Azure, or GCP.
Strong grounding in application security, network security, and identity and access management, including least-privilege and Zero Trust principles.
Experience applying threat modeling methodologies and translating findings into practical design changes.
Working knowledge of relevant regulations and standards, such as PCI DSS, GDPR, or ISO 27001.
Ability to explain technical risk in actionable terms for non-technical stakeholders and influence decisions without direct authority.
A bachelor's degree in a related field or equivalent experience.
Sound judgment in weighing risk against business speed and making clear recommendations.
Comfort working at both whiteboard-design and deep-technical levels, with strong written and verbal communication for audiences ranging from engineers to executives.
Ability to build trust and influence teams outside the reporting line.

Nice To Haves

Certifications such as CISSP, SABSA, TOGAF, CCSP, Microsoft Cybersecurity Architect Expert, or a cloud security specialty certification such as Azure Security Engineer, AWS Security Specialty, or Google Professional Cloud Security Engineer.
Experience supporting technical due diligence for mergers and acquisitions or major vendor integrations.
Familiarity with DevSecOps and embedding security into CI/CD pipelines.
Familiarity with security considerations for AI/ML systems, such as prompt injection and AI governance frameworks.
Experience evaluating emerging technologies, including AI-assisted booking and new payment rails.

Responsibilities

Review designs for new products, platforms, and major changes using structured threat modeling, such as STRIDE, to identify risks, gaps, and single points of failure.
Turn review findings into actionable recommendations that balance risk, cost, and delivery timelines.
Own the security architecture review process, define what is secure enough at each design stage, and produce reference architectures and reusable patterns.
Set cloud security standards for AWS, Azure, and GCP environments, including segmentation, workload isolation, IAM, encryption, and secrets management.
Guide secure API and microservices design, including authentication, authorization, and rate limiting.
Protect traveler and payment data throughout its lifecycle, including PCI DSS flows, and promote privacy-by-design and data minimization with Privacy and Data Security Investigations teams.
Assess integrations with airlines, hotels, GDSs such as Sabre, Amadeus, and Travelport, payment processors, and other travel suppliers.
Support technical due diligence for new vendors, partnerships, and acquisitions.
Define secure integration patterns for supplier onboarding.
Review AI/ML implementations before launch and assess risks such as prompt injection, output data leakage, and over-permissioned agents.
Define AI guardrails and agentic AI patterns, including scoped permissions, approval workflows, audit trails, AI-specific logging and monitoring, and revocation of misbehaving agents.
Set standards for model provenance and versioning, vet third-party model providers, and define when human review is required before launch.
Define identity standards for AI agents and non-human accounts, including unique identities, least-privilege access, and credential lifecycle management.
Assess AI agent authentication and delegated-action risks, including impersonation and token misuse.
Set authorization boundaries for AI agents involved in provisioning, deprovisioning, or access reviews.
Maintain and evolve security architecture standards, guardrails, and design principles, and create reusable frameworks that improve engineering quality and speed.
Align architecture decisions with frameworks and regulations, including NIST CSF, ISO 27001, PCI DSS, GDPR, and SOC 2.
Translate technical risks and trade-offs into terms that engineering, product, and executive stakeholders can act on.
Partner with Cyber Defense teams, including CSIRT, CTI, Detection Engineering, and Data Security Investigations, to incorporate incident lessons and threat intelligence into architecture decisions.
Mentor engineers and junior architects on secure design.
Influence decisions across teams without direct authority and recommend strong future-state security architecture approaches for emerging technologies.

Benefits

Discretionary annual bonus based on company and individual performance.
Health and welfare insurance plans.
Retirement programs.
Parental leave.
Adoption assistance.
Wellbeing resources for employees and their immediate family.
Travel deals from major travel providers on flights, hotels, cruises, and car rentals.
Access to over 20,000 courses on a learning platform and leadership courses.
Internal candidates have priority access to new job openings.
Global Inclusion Groups.