Senior Manager - Application Security Research

Job ID: 26015688Posted: 2026-10-23Location: Phoenix, AZ, United States; New York, NY, United States; Atlanta, GA, United StatesSalary: $123000 - $215250 annually + bonus + benefitsJob Function: CybersecuritySchedule: Full timeShift: DayWorkplace: HybridCareer Area: TechnologyCompany: American ExpressDescriptionJoining Amex Tech means discovering and shaping your contribution to something big. Here, you can work alongside talented tech teams and build a unique career with the Powerful Backing of American Express. With a range of opportunities to work with the latest technologies, and a commitment to back the broader engineering community through open source, our mission is to power your success. Because Amex Tech is powered by our technology, our culture, and our colleagues.The Technology organization enables and accelerates the company’s growth strategies, delivering global capabilities and services in support of Amex’s customers and colleagues, while maintaining 24/7 servicing and availability to ensure an uninterrupted, high-quality customer experience. Technology provides the foundation for everything we do in the company while driving differentiation through building and leveraging innovative technology and data insights.At American Express, our mission is to deliver the world’s best customer experience every day. At the heart of this mission is our Information Security organization, enabling exceptional experiences built on a foundation of trust, service, and security. We leverage advanced technologies and data-driven insights to stay ahead of an evolving threat landscape. We foster a culture of passion, curiosity, and courage—empowering you to innovate, grow, and help shape the future of a Fortune 100 company.Trust. Service. Security. American Express is seeking a highly technical and innovative Senior Manager of Application Security Research to help advance our application security research, vulnerability discovery, and threat analysis capabilities.Reporting to the Director of Application Security, this role will lead and actively contribute to advanced security research focused on identifying, analyzing, and mitigating vulnerabilities across applications, software components, APIs, AI/ML, and emerging technologies.The ideal candidate combines deep hands-on expertise in reverse engineering, vulnerability research, secure code review, and software engineering with the ability to translate technical discoveries into actionable security intelligence.This position works closely with the American Express Fusion Center, Security Operations Center (SOC), Cyber Threat Intelligence, Incident Response, and engineering teams to identify emerging threats, develop indicators of compromise (IoCs), improve detection capabilities, and proactively protect American Express against sophisticated cyber threats.This is a hands-on technical leadership position requiring strong research capabilities, engineering expertise, and the ability to investigate complex security challenges independently while guiding others.ResponsibilitiesMonitors application security systems to identify potential threats and vulnerabilities, ensuring timely detection and prevention of software security defectsManages application security platforms and processes, serving as a subject matter expert to ensure robust protection and compliance with industry standardsPromotes the adoption of best practices, new technologies, and innovative solutions within the team, fostering continuous improvement and a culture of excellenceOversees vulnerability management and/or application security testing to ensure remediation priorities align with organizational risk management strategiesOversees development, implementation, and maintenance of security policies, procedures, and standards to ensure compliance with industry best practices and regulatory requirementsPlans event response efforts and ensures thorough investigation measures, remediation, and communication with stakeholdersContributes to the development and continuous improvement of the organization's application security program, ensuring alignment with regulatory requirements and business objectives set by senior leadershipSupports the onboarding of new products, data, processes, or tools by identifying requirements and integrating them into operations (processes, playbooks, and training)Conducts and manages periodic security assessments and audits to identify vulnerabilities and risks and develop mitigation strategiesProvides strategic recommendations to senior leadership to align on key security objectives, policies and integration of security measures into business processesProvides key inputs on creating security training programs, provides gap analysis and suggested learning interventions to increase awareness in application security best practicesWrites, reviews, and directs colleagues on publishing reports / dashboards / documentation on application security events, findings, and recommendations for improvements, providing valuable insights for management and stakeholdersMay or may not oversee and mentor a team of Cybersecurity Operations & Assurance colleagues, enabling a culture of continuous learning, growth opportunities, and inclusivity for individual colleagues and teams through mentoring, feedback, and metrics, and ensuring adherence to best practices and standardsMay or may not provide direct leadership and coaching to Cybersecurity Operations & Assurance teams, supporting training and development of best practicesMay or may not manage resource allocation, project timeline, and budget for projects, ensuring alignment with organizational goalsMay or may not collaborate with senior leadership to hire top talent for the team, ensuring a high-functioning and cohesive unit, implementing strategies for talent retention and professional developmentCollaborates and co-creates effectively with teams in product and the business to align technology initiatives with business objectiveLeads adoption of AI-enabled cybersecurity operations capabilities to improve threat detection, incident response efficiency, vulnerability prioritization, and operational decision-making across security processes, while ensuring appropriate validation of AI-generated outputs before operational useLeverages AI-assisted analytics, threat intelligence, and workflow automation tools to enhance security monitoring, threat hunting, reporting, and remediation activities while maintaining appropriate governance and oversight, and validation of AI-generated findings, recommendations, and decisionsProvides guidance on the secure and responsible use of AI-enabled technologies within cybersecurity operations, including expectations for validating AI-generated outputs, ensuring alignment with organizational policies, regulatory requirements, and risk management strategiesEstablishes and promotes effective Prompt Design practices across the team, guiding colleagues in the use of structured prompts to improve threat detection, incident response, operational reporting, threat intelligence analysis, and cybersecurity workflow efficiency while ensuring appropriate human oversight and validationQualificationsBachelor's Degree in Computer Science, Information Systems, Cybersecurity, and/or comparable experience; advanced degree preferredKnowledge of regulatory compliance and security standardsKnowledge of Identity & Access ManagementKnowledge of Security Architecture ManagementKnowledge of Security Governance and OperationsKnowledge of Security Testing & RemediationKnowledge of Cloud Security ManagementKnowledge of Data Privacy & Protection (DPP, GDPR)Knowledge of AI-enabled cybersecurity operations platforms, automated threat detection techniques, and AI-assisted security analytics capabilitiesUnderstanding of AI security risks, responsible AI governance principles, and the operational implications of AI-enabled technologies within cybersecurity environmentsExperience in cybersecurity operations and application securityExperience in Technical Writing and Documentation DevelopmentExperience with SCA/SAST/DAST/MAST/API Security Experience in network security, understanding of network security principles, including firewalls, VPNs, and network segmentationExperience in vulnerability scanning tools (e.g., Nessus, Qualys, Rapid7) and remediation processesExperience with penetration testing using industry-standard tools (e.g., Burp Suite, Wireshark, Metasploit, SQL map) for ongoing monitoring and complianceExperience in working on incident response efforts, including forensic analysis, malware analysis, and threat huntingExperience in securing cloud environments (e.g., AWS, Azure, Google Cloud) and implementing cloud security best practicesExperience in regulatory requirements and standards (e.g., PCI-DSS, ISO 27001, NIST) and their application in cybersecurity operationsExperience in Business Continuity Planning and Disaster RecoveryAt least one security related certification preferred like: GCPN, GWEB, GMOB, GOAA, GPEN, GWAT, GPEN, GXPN, GREM, CEH, C|ASE .NET, C|ASE Java, OSCP, OSWA, OSWE, CSSLP, otherEmployment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.