Senior Manager - Application Security Research

American Express•Phoenix, AZ

About The Position

American Express is seeking a highly technical and innovative Senior Manager of Application Security Research to advance application security research, vulnerability discovery, and threat analysis. Reporting to the Director of Application Security, this role leads and contributes to research focused on identifying, analyzing, and mitigating vulnerabilities across applications, software components, APIs, AI/ML, and emerging technologies. The position combines hands-on expertise in reverse engineering, vulnerability research, secure code review, and software engineering with the ability to turn technical findings into actionable security intelligence. The role works closely with the American Express Fusion Center, Security Operations Center (SOC), Cyber Threat Intelligence, Incident Response, and engineering teams to identify emerging threats, develop indicators of compromise (IoCs), improve detection capabilities, and proactively protect the company. It is a hands-on technical leadership position involving independent investigation of complex security challenges and guidance to others. The Technology organization provides global capabilities and services that support customers and colleagues, enable company growth, and maintain 24/7 service availability. The Information Security organization uses advanced technologies and data-driven insights to address evolving threats and support a customer experience built on trust, service, and security. Employment eligibility to work with American Express in the United States is required. The company will not pursue visa sponsorship for this position.

Requirements

Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or comparable experience.
Knowledge of regulatory compliance and security standards.
Knowledge of Identity & Access Management.
Knowledge of Security Architecture Management.
Knowledge of Security Governance and Operations.
Knowledge of Security Testing & Remediation.
Knowledge of Cloud Security Management.
Knowledge of Data Privacy & Protection, including DPP and GDPR.
Knowledge of AI-enabled cybersecurity operations platforms, automated threat detection techniques, and AI-assisted security analytics capabilities.
Understanding of AI security risks, responsible AI governance principles, and operational implications of AI-enabled technologies in cybersecurity environments.
Experience in cybersecurity operations and application security.
Experience in technical writing and documentation development.
Experience with SCA, SAST, DAST, MAST, and API Security.
Experience in network security, including principles involving firewalls, VPNs, and network segmentation.
Experience with vulnerability scanning tools such as Nessus, Qualys, or Rapid7, and remediation processes.
Experience with penetration testing using industry-standard tools such as Burp Suite, Wireshark, Metasploit, or SQL map.
Experience working on incident response efforts, including forensic analysis, malware analysis, and threat hunting.
Experience securing cloud environments such as AWS, Azure, or Google Cloud and implementing cloud security best practices.
Experience with regulatory requirements and standards such as PCI-DSS, ISO 27001, and NIST and their application in cybersecurity operations.
Experience in Business Continuity Planning and Disaster Recovery.
Employment eligibility to work in the United States; American Express will not pursue visa sponsorship.

Nice To Haves

Advanced degree preferred.
A security-related certification preferred, such as GCPN, GWEB, GMOB, GOAA, GPEN, GWAT, GXPN, GREM, CEH, C|ASE .NET, C|ASE Java, OSCP, OSWA, OSWE, or CSSLP.

Responsibilities

Monitor application security systems to identify potential threats and vulnerabilities and support timely detection and prevention of software security defects.
Manage application security platforms and processes as a subject matter expert, supporting robust protection and compliance with industry standards.
Promote best practices, new technologies, and innovative solutions within the team to foster continuous improvement.
Oversee vulnerability management and/or application security testing, aligning remediation priorities with organizational risk management strategies.
Oversee development, implementation, and maintenance of security policies, procedures, and standards in line with industry best practices and regulatory requirements.
Plan event response efforts and ensure thorough investigation, remediation, and stakeholder communication.
Contribute to the development and continuous improvement of the application security program, aligned with regulatory requirements and business objectives.
Support onboarding of new products, data, processes, and tools by identifying requirements and integrating them into operations, playbooks, and training.
Conduct and manage periodic security assessments and audits, identify vulnerabilities and risks, and develop mitigation strategies.
Provide strategic recommendations to senior leadership on security objectives, policies, and integrating security measures into business processes.
Contribute to security training programs through input, gap analysis, and suggested learning interventions that increase awareness of application security best practices.
Write, review, and guide colleagues in publishing reports, dashboards, and documentation on application security events, findings, and recommendations.
As applicable, oversee and mentor Cybersecurity Operations & Assurance colleagues, support learning and development, provide feedback, and promote adherence to best practices and standards.
As applicable, provide leadership and coaching to Cybersecurity Operations & Assurance teams and support training and development of best practices.
As applicable, manage project resources, timelines, and budgets in alignment with organizational goals.
As applicable, collaborate with senior leadership on hiring and talent retention and professional development strategies.
Collaborate with product and business teams to align technology initiatives with business objectives.
Lead adoption of AI-enabled cybersecurity operations capabilities to improve threat detection, incident response efficiency, vulnerability prioritization, and operational decision-making, validating AI-generated outputs before operational use.
Use AI-assisted analytics, threat intelligence, and workflow automation tools to enhance security monitoring, threat hunting, reporting, and remediation, with appropriate governance and validation of AI-generated findings and recommendations.
Guide secure and responsible use of AI-enabled technologies in cybersecurity operations, aligning with organizational policies, regulatory requirements, and risk management strategies.
Establish and promote effective prompt design practices, guiding colleagues in structured prompts for security operations while ensuring human oversight and validation.