Cybersecurity Architect II

American Express•Phoenix, AZ

1d•Hybrid

About The Position

American express is seeking Senior Network Security Engineer with deep expertise in cloud networking, zero trust security, and hybrid/multi-cloud architectures with proven ability to design, secure, and automate highly available cloud network environments while reducing risk and operational overhead. Recognized for strong analytical problem-solving, cross-functional collaboration, and delivering secure-by-design solutions at scale.

Requirements

Extensive hands-on experience designing and securing AWS VPCs, Azure Virtual Networks, and GCP VPCs, including subnet architecture, routing, NAT gateways, private endpoints, and security enforcement using cloud-native controls.
Experience implementing and operating AWS Direct Connect, Azure ExpressRoute, and GCP Cloud Interconnect to support secure hybrid and multi-cloud connectivity.
Specialized in deploying cloud firewalls, WAFs, DDoS protection, and Zero Trust access models to protect workloads, APIs, and users.
Demonstrated proficiency in cloud-native networking and security controls across AWS, Azure, and GCP, including segmentation, identity-aware access, and traffic inspection.
AWS, Microsoft Azure, Google Cloud Platform (GCP) VPC/VNet architecture, subnet design, routing, NAT gateways, private endpoints
Hybrid and multi-cloud connectivity (site-to-site VPN, cloud interconnects)
Palo Alto Networks, AWS Security Groups, GCP Firewall Rules
Firewall policy design, threat prevention, IPS/IDS, SSL/TLS inspection
Zero Trust networking, least-privilege access, network segmentation
Terraform for multi-cloud infrastructure and security controls
GitHub for source control and collaboration
Core networking fundamentals: TCP/IP, BGP, routing, VPN technologies
Logging and monitoring fundamentals (firewall logs, flow logs, SIEM integration)

Nice To Haves

GitHub Actions for CI/CD automation, security checks, and policy enforcement
Load balancing (L4/L7), traffic segmentation, high availability design
Identity and access integration with network security controls
Linux fundamentals and scripting for automation support
CCNA- Cisco Certified Network Associate
AWS - Aws Certified DevOps Engineer
GCP - Google Cloud Certified Professional Cloud DevOps Engineer

Responsibilities

Design and evolve secure cloud network architectures across AWS, Azure, and GCP in alignment with security standards and business requirements.
Implement, tune, and maintain Palo Alto, Security Group, and GCP firewall policies, balancing security controls with application performance and usability.
Develop and maintain reusable Terraform modules to standardize cloud network security deployments.
Embed network security controls into CI/CD pipelines using GitHub Actions, enabling consistent, automated, and auditable deployments.
Partner with application, platform, and security teams to influence secure design decisions early in the development lifecycle.
Perform regular security posture reviews of network configurations and firewall rules, identifying gaps and driving remediation efforts.
Create and maintain clear documentation, reference architectures, and standards to support scalable and repeatable network security practices.

Benefits

Competitive base salaries
Bonus incentives
6% Company Match on retirement savings plan
Free financial coaching and financial well-being support
Comprehensive medical, dental, vision, life insurance, and disability benefits
Flexible working model with hybrid, onsite or virtual arrangements depending on role and business need
20+ weeks paid parental leave for all parents, regardless of gender, offered for pregnancy, adoption or surrogacy
Free access to global on-site wellness centers staffed with nurses and doctors (depending on location)
Free and confidential counseling support through our Healthy Minds program
Career development and training opportunities