> Markdown version of [/jobs/ext/2909464-sr-application-security-architect-ai-api](https://www.wearedevelopers.com/jobs/ext/2909464-sr-application-security-architect-ai-api). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Sr. Application Security Architect (AI & API) - **Company:** American Express Global Business Travel - **Location:** UK (Remote available) - **Experience:** Expert - **Salary:** £84,293.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, User Authentication, Microsoft Azure, Cloud Engineering, Cyber Security, Cursor (Graphical User Interface Elements), Programming Tools, Python (Programming Language), OAuth, Open Web Application Security, PCI Data Security Standards, Systems Development Life Cycle, Openid Connect, Azure Machine Learning, JSON Web Token, Secure Coding, Software Engineering, Software Vulnerability Management, GitHub Copilot, Large Language Models, IT Architecture, Software Security, Kubernetes, Information Technology, Graphql, Api Design, Api Gateway, Static Application Security Testing, Golang, Programming Languages, Dynamic Application Security Testing - **Published:** September 15, 2026 - **Apply:** https://dejobs.org/x/x/0B5F1D7908B2431B9F11F52AED459FD8/job/ ## About the Role * 10+ years of experience in software engineering, application security, or security architecture, including experience guiding or reviewing both application and API architecture decisions at scale. * Strong foundation in application security fundamentals - secure SDLC, vulnerability management (SAST/DAST/SCA), secure coding practices, and OWASP Top 10 - in addition to deep API- and AI-specific expertise. * Deep expertise in API design and security, including OAuth 2.0, OpenID Connect, JWT/JOSE, and API gateway/service mesh architectures. * Strong ability to evaluate and clearly communicate architectural tradeoffs, translating complex technical decisions into guidance that development teams can act on. * Experience assessing and securing existing application, API, and AI implementations, including working with API gateways and/or AI gateways. * Hands-on experience with cloud-native architectures (AWS, Azure, or GCP) and container orchestration (Kubernetes). * Practical experience with AI-native and agentic development tools (e.g., Claude Code, GitHub Copilot, Cursor, or similar) and a clear understanding of the security implications of AI-assisted and autonomous development workflows. * Strong background in applied cryptography and secure software design. * Proven ability to lead threat modeling, secure design reviews, and architecture governance for both traditional applications and AI/API-centric systems across cross-functional engineering organizations. * Proficiency in multiple programming languages (e.g., Go, Java, Python). * Excellent written and verbal communication skills, including experience developing technical policy, standards, or training materials. * Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent practical experience. Preferred qualities * Advanced degree (M.Sc./Ph.D.) in Computer Science, Artificial Intelligence, or a related field. * Track record of thought leadership: publications, conference talks, published CVEs, or contributions to security/API standards bodies (e.g., IETF OAuth/JOSE working groups). * Experience with regulatory or compliance frameworks such as PCI-DSS. * Experience securing AI/LLM-powered systems and agentic architectures, including AI gateway deployments. * Background in broader application security program leadership (e.g., vulnerability management, secure SDLC rollout) beyond API- and AI-specific initiatives. * Experience leading or mentoring engineering teams in a principal/staff-level individual contributor or architect capacity. ## Description We're looking for a Senior Application Security Architect with a deep specialization in AI and API security to help Amex GBT's development teams make sound architectural choices and build secure software. This role covers the full spectrum of application security - secure SDLC, vulnerability management, and secure coding practices - with a particular focus on the APIs and AI/agentic systems that are increasingly central to our platform. Rather than designing architectures in isolation, you'll guide engineering teams toward the right approach for their use case, educate them on the tradeoffs between options, and work hands-on to help implement and secure what they build. You'll also assess and strengthen the security of our existing application, API, and AI implementations, using tooling such as API and AI gateways, and act as a trusted technical advisor across engineering., * Serve as a senior application security architect for Amex GBT's engineering organization, with a primary focus on API and AI/agentic systems while maintaining broad ownership of secure SDLC and application security practices. * Guide engineering teams in selecting the right application, API, and AI/agentic architecture patterns for their use case, clearly explaining the tradeoffs between approaches (e.g., REST vs. GraphQL vs. gRPC, synchronous vs. event-driven, different AI/agent frameworks). * Educate and advise development teams on the security, scalability, and maintainability implications of different application, API, and AI/agentic design choices. * Partner hands-on with development teams to implement and secure chosen application, API, and AI architectures, including authentication, authorization (OAuth 2.0, OpenID Connect, JOSE/JWT), and API/AI gateway configuration. * Assess and secure existing application, API, and AI implementations, using appropriate tooling (such as SAST/DAST/SCA, API gateways, and AI gateways) to identify and close security gaps. * Guide the secure adoption of AI-native and agentic development workflows (e.g., AI-assisted IDEs, agentic coding platforms) across engineering, balancing productivity gains with security and governance. * Lead threat modeling and secure design reviews across applications, APIs, AI/ML services, and agentic systems, identifying risks specific to LLM-powered and autonomous components (e.g., prompt injection, data exfiltration, model misuse). * Partner with engineering, security, legal, and product leadership to define governance policies and standards for application design, API design, and responsible AI/agentic tool usage. * Provide technical leadership and mentorship on applied cryptography, secure coding, secure API design, and cloud-native architecture (Kubernetes, AWS/GCP/Azure). * Represent Amex GBT in industry standards efforts related to application and API security and AI governance (e.g., OAuth, JOSE, emerging AI/agent security standards). * Develop and maintain decision frameworks, tradeoff guides, and documentation to help teams evaluate and secure their application, API, and AI architecture choices. * Generate security KPI and metrics reporting across security programs to measure progress and effectiveness, and present findings to senior leadership., * Flexible benefits are tailored to each country and start the day you do. These include health and welfare insurance plans, retirement programs, parental leave, adoption assistance, and wellbeing resources to support you and your immediate family. * Travel perks: get a choice of deals each week from major travel providers on everything from flights to hotels to cruises and car rentals. * Develop the skills you want when the time is right for you, with access to over 20,000 courses on our learning platform, leadership courses, and new job openings available to internal candidates first. * We strive to champion Inclusion in every aspect of our business at Amex GBT. You can connect with colleagues through our global INclusion Groups, centered around common identities or initiatives, to discuss challenges, obstacles, achievements, and drive company awareness and action. * And much more! All applicants will receive equal consideration for employment without regard to age, sex, gender (and characteristics related to sex and gender), pregnancy (and related medical conditions), race, color, citizenship, religion, disability, or any other class or characteristic protected by law. Click Here (https://explorer.amexglobalbusinesstravel.com/rs/346-POJ-129/images/Additional%20Disclosures%20in%20Accordance%20with%20the%20LA%20County%20Fair%20Chance%20Ordinance.pdf?version=2) for Additional Disclosures in Accordance with the LA County Fair Chance Ordinance. ## Related Videos - [Lessons learned from observing a billion API requests](https://www.wearedevelopers.com/videos/1574-lessons-learned-from-observing-a-billion-api-requests) - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Go with the Flow: Stop the Leaks Before Your Memory's a Waterfall!](https://www.wearedevelopers.com/videos/100073-go-with-the-flow-stop-the-leaks-before-your-memory-s-a-waterfall) - [Putting the Graph In GraphQL With The Neo4j GraphQL Library](https://www.wearedevelopers.com/videos/257-putting-the-graph-in-graphql-with-the-neo4j-graphql-library) - [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) - [The New AI Security Stack: Observe, Detect, Protect](https://www.wearedevelopers.com/videos/100302-the-new-ai-security-stack-observe-detect-protect) ## Related Articles - [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift) - [How to Become an AI Engineer](https://www.wearedevelopers.com/magazine/331-how-to-become-an-ai-engineer) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [Trustworthy AI Starts at Deployment: 5 Checks Before You Ship](https://www.wearedevelopers.com/magazine/753-trustworthy-ai-starts-at-deployment-5-checks-before-you-ship) - [What is Software Engineering in the Age of AI?](https://www.wearedevelopers.com/magazine/640-what-is-software-engineering-in-the-age-of-ai) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)