Senior Manager - Application Security Research

American Express•Phoenix, AZ

2d•$123,000 - $215,250

About The Position

American Express is seeking a highly technical and innovative Senior Manager of Application Security Research to advance application security research, vulnerability discovery, and threat analysis. Reporting to the Director of Application Security, this hands-on technical leadership role leads and contributes to research to identify, analyze, and mitigate vulnerabilities across applications, software components, APIs, AI/ML, and emerging technologies. The role combines reverse engineering, vulnerability research, secure code review, and software engineering expertise with the ability to turn technical discoveries into actionable security intelligence. The position works closely with the American Express Fusion Center, Security Operations Center (SOC), Cyber Threat Intelligence, Incident Response, and engineering teams to identify emerging threats, develop indicators of compromise, improve detection capabilities, and protect American Express against sophisticated cyber threats. It also supports application security operations, vulnerability remediation, security governance, and the responsible adoption of AI-enabled cybersecurity capabilities. The role requires independently investigating complex security challenges while guiding others. Employment eligibility to work in the United States is required; American Express will not pursue visa sponsorship for this position.

Requirements

Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or comparable experience.
Knowledge of regulatory compliance and security standards.
Knowledge of Identity & Access Management.
Knowledge of Security Architecture Management.
Knowledge of Security Governance and Operations.
Knowledge of Security Testing & Remediation.
Knowledge of Cloud Security Management.
Knowledge of Data Privacy & Protection, including DPP and GDPR.
Knowledge of AI-enabled cybersecurity operations platforms, automated threat detection techniques, and AI-assisted security analytics.
Understanding of AI security risks, responsible AI governance principles, and the operational implications of AI-enabled technologies in cybersecurity environments.
Experience in cybersecurity operations and application security.
Experience in technical writing and documentation development.
Experience with SCA, SAST, DAST, MAST, and API security.
Experience in network security, including firewalls, VPNs, and network segmentation.
Experience with vulnerability scanning tools such as Nessus, Qualys, or Rapid7 and remediation processes.
Experience with penetration testing using tools such as Burp Suite, Wireshark, Metasploit, or SQLmap.
Experience with incident response, including forensic analysis, malware analysis, and threat hunting.
Experience securing cloud environments such as AWS, Azure, or Google Cloud and implementing cloud security best practices.
Experience with regulatory requirements and standards such as PCI-DSS, ISO 27001, and NIST and their application in cybersecurity operations.
Experience in Business Continuity Planning and Disaster Recovery.
Eligibility to work in the United States; the company will not pursue visa sponsorship.

Nice To Haves

Advanced degree preferred.
At least one security-related certification preferred, such as GCPN, GWEB, GMOB, GOAA, GPEN, GWAT, GXPN, GREM, CEH, C|ASE .NET, C|ASE Java, OSCP, OSWA, OSWE, or CSSLP.

Responsibilities

Monitor application security systems to identify potential threats and vulnerabilities and support timely detection and prevention of software security defects.
Manage application security platforms and processes as a subject matter expert, ensuring robust protection and compliance with industry standards.
Promote best practices, new technologies, and innovative solutions within the team to foster continuous improvement.
Oversee vulnerability management and/or application security testing, aligning remediation priorities with organizational risk strategies.
Oversee the development, implementation, and maintenance of security policies, procedures, and standards in line with industry best practices and regulatory requirements.
Plan event response efforts and ensure thorough investigation, remediation, and stakeholder communication.
Contribute to the development and continuous improvement of the application security program in alignment with regulatory requirements and business objectives.
Support onboarding of products, data, processes, and tools by identifying requirements and integrating them into operations, playbooks, and training.
Conduct and manage periodic security assessments and audits, identify vulnerabilities and risks, and develop mitigation strategies.
Provide strategic recommendations to senior leadership on security objectives, policies, and integrating security into business processes.
Contribute to security training programs, gap analyses, and learning interventions that increase awareness of application security best practices.
Write and review reports, dashboards, and documentation on application security events, findings, and improvement recommendations; guide colleagues in publishing these materials.
May oversee and mentor Cybersecurity Operations & Assurance colleagues, supporting learning, growth, inclusivity, feedback, and adherence to best practices and standards.
May provide direct leadership and coaching to Cybersecurity Operations & Assurance teams, supporting training and development of best practices.
May manage project resources, timelines, and budgets in alignment with organizational goals.
May collaborate with senior leadership on hiring and talent retention and professional development strategies.
Collaborate with product and business teams to align technology initiatives with business objectives.
Lead adoption of AI-enabled cybersecurity operations capabilities to improve threat detection, incident response efficiency, vulnerability prioritization, and operational decision-making, validating AI-generated outputs before operational use.
Use AI-assisted analytics, threat intelligence, and workflow automation to enhance security monitoring, threat hunting, reporting, and remediation, with appropriate governance and oversight.
Guide secure and responsible use of AI-enabled technologies in cybersecurity operations, including validation of AI outputs and alignment with organizational policies, regulatory requirements, and risk strategies.
Establish and promote effective prompt design practices for threat detection, incident response, operational reporting, threat intelligence analysis, and cybersecurity workflow efficiency, with human oversight and validation.