[Hiring] Senior DevSecOps Engineer @American Express Global Business Travel

Role Description

We are seeking an experienced Senior DevSecOps Engineer to join our dynamic team in the corporate travel industry. This remote position requires a unique blend of application development experience and security expertise to build, secure, and maintain our cloud-native infrastructure. The ideal candidate will have transitioned from application development into DevSecOps, bringing a developer’s mindset to security and operations.

• Work with DevOps teams to design, implement, and maintain secure CI/CD pipelines integrating security testing at every stage of the software development lifecycle.
• Implement automated security scanning including SAST, DAST, SCA, container scanning.
• Deploy and support API Security tools.
• Ensure tools consistently report to aggregator.
• Collaborate with development teams to promote secure coding practices and provide security guidance throughout the development process.
• Ensure compliance with industry standards relevant to the travel industry including PCI-DSS, GDPR, and SOC 2.
• Mentor junior engineers and promote a security-first culture across engineering teams.

Qualifications

• 5+ years of professional software development experience with demonstrable expertise in at least one major programming language (Python, Go, Java, JavaScript/TypeScript, or similar).
• 3+ years of hands-on DevSecOps or Security Engineering experience.
• Strong knowledge of OWASP.
• Strong cloud security expertise with at least one major cloud service provider (AWS, Azure, or GCP).
• Strong knowledge of API Security and associated security tools (Salt, Akamai, Cloudflare, or similar).
• Deep understanding of cloud-native security including IAM, network security, encryption, secrets management, and compliance frameworks.
• Proficiency with CI/CD tools (Jenkins, GitLab CI, GitHub Actions, CircleCI, or similar).
• Experience with Infrastructure as Code tools (Terraform, CloudFormation, Ansible, or similar).
• Practical experience with containerization and orchestration technologies (Docker, Kubernetes, ECS, or similar).
• Strong understanding of network security, authentication protocols, and secure API design.
• Excellent communication skills with ability to explain security concepts to technical and non-technical audiences.
• Experience in the travel, hospitality, or e-commerce industry.
• Multi-cloud experience across AWS, Azure, and GCP.
• Professional security certifications (CISSP, CEH, OSCP, AWS Security Specialty, Azure Security Engineer, or similar).
• Knowledge of compliance frameworks specific to payment processing and international data protection (PCI-DSS, GDPR, CCPA).
• Background in penetration testing or red team operations.
• Experience with threat modeling methodologies (STRIDE, PASTA, OCTAVE) and risk assessment frameworks.
• Knowledge of MLSecOps practices including model security, data pipeline protection, and AI/ML supply chain security.
• Contributions or security research publications.

Requirements

• Programming & Scripting: Python, Go, Bash, PowerShell, JavaScript/TypeScript.
• Cloud Platforms: AWS (EC2, ECS, EKS, Lambda, S3, IAM, CloudWatch, GuardDuty) or Azure (VMs, AKS, Functions, Key Vault, Sentinel) or GCP (Compute Engine, GKE, Cloud Functions, IAM, Security Command Center).
• Security Tools: SAST/DAST scanners, WAF solutions, SIEM platforms, vulnerability scanners, secrets management tools.
• CI/CD: Jenkins, GitLab CI/CD, GitHub Actions, CircleCI, Azure DevOps.
• Infrastructure: Terraform, Docker, Kubernetes, Helm, Ansible.
• Version Control: Git, GitHub, GitLab, Bitbucket.

Benefits

• Flexible benefits tailored to each country, starting the day you do, including health and welfare insurance plans, retirement programs, parental leave, adoption assistance, and wellbeing resources.
• Travel perks with choices of deals each week from major travel providers on flights, hotels, cruises, and car rentals.
• Access to over 20,000 courses on our learning platform, leadership courses, and new job openings available to internal candidates first.
• Championing Inclusion through global INclusion Groups to discuss challenges, obstacles, achievements, and drive company awareness and action.