Sr. Application Security Engineer

Overview

Senior Application Security Engineer role at Amex GBT focused on embedding security across the software development lifecycle, CI/CD pipelines, cloud environments and AI-assisted coding practices.

What you'll do

• Partner with DevOps teams to architect and maintain secure CI/CD pipelines that embed security testing throughout the software development lifecycle.
• Deploy and fine-tune automated security tools including SAST, DAST, SCA, and container scanning, with centralized reporting and aggregation of findings across the organization.
• Deploy and manage API security tools while ensuring cloud-native security best practices across IAM, network security, encryption, secrets management, and compliance frameworks.
• Collaborate with development teams to establish and reinforce secure coding standards, provide hands-on security guidance, and champion a security-first culture across engineering.
• Evaluate and establish guardrails for the safe adoption of AI-assisted coding tools across engineering teams, identifying and mitigating risks such as hallucinated dependencies, injected vulnerabilities, and governance gaps.
• Maintain adherence to industry standards (PCI-DSS, GDPR, SOC 2) relevant to the travel industry, build KPI dashboards for application security initiatives, and communicate findings to leadership.
• Guide junior engineers in security best practices, foster a security-conscious engineering culture, and contribute to the evolution of the organization's security posture.

What you'll need

• 5+ years of professional software development with demonstrated mastery in at least one major programming language (Python, Go, Java, JavaScript/TypeScript, or equivalent).
• 3+ years of hands-on application security or DevSecOps experience.
• Deep expertise in OWASP Top 10, secure coding practices, and API security.
• Strong cloud security knowledge with hands-on experience in AWS, Azure, or GCP.
• Proficiency with CI/CD tools (Jenkins, GitLab CI/CD, GitHub Actions, CircleCI, Azure DevOps) and infrastructure-as-code technologies (Terraform, Docker, Kubernetes).
• Advanced understanding of cloud-native security, including IAM, network security, encryption, and secrets management.
• Practical experience with security tools (SAST/DAST scanners, WAF solutions, SIEM platforms, vulnerability scanners).
• Familiarity with agentic AI programming tools (GitHub Copilot, Cursor, Claude Code) and AI-specific security tooling.
• Experience evaluating and securing agentic AI coding tools with understanding of associated risks (hallucinated dependencies, code injection, governance gaps).
• Ability to design and implement guardrails and detection strategies for safe AI tool adoption.
• Excellent communication abilities, capable of translating complex security concepts for both technical and non-technical audiences.
• Mentoring mindset with a passion for building security culture.
• Developer-first perspective that bridges application development and security.

Nice to have

• Multi-cloud experience (AWS, Azure, GCP).
• Professional security certifications (CISSP, GIAC, OSCP, AWS Security Specialty, Azure Security Engineer).
• Background in penetration testing, red team operations, or threat modeling.
• Knowledge of MLSecOps and AI/ML supply chain security.
• Experience in travel, hospitality, or e-commerce industries.
• Open-source security contributions or published security research.

Details

• Location: India.