Cybersecurity Engineer II (Public Cloud Network Security/ AWS/ Palo Alto/ AI)

Joining Amex Tech means discovering and shaping your contribution to something big. Here, you can work alongside talented tech teams and build a unique career with the Powerful Backing of American Express. With a range of opportunities to work with the latest technologies, and a commitment to back the broader engineering community through open source, our mission is to power your success. Because Amex Tech is powered by our technology, our culture, and our colleagues. The Technology organization enables and accelerates the company’s growth strategies, delivering global capabilities and services in support of Amex’s customers and colleagues, while maintaining 24/7 servicing and availability to ensure an uninterrupted, high-quality customer experience. Technology provides the foundation for everything we do in the company while driving differentiation through building and leveraging innovative technology and data insights. At American Express, our mission is to deliver the world’s best customer experience every day. At the heart of this mission is our Information Security organization, enabling exceptional experiences built on a foundation of trust, service, and security. We leverage advanced technologies and data-driven insights to stay ahead of an evolving threat landscape. We foster a culture of passion, curiosity, and courage—empowering you to innovate, grow, and help shape the future of a Fortune 100 company. Trust. Service. Security. We are seeking a Public Cloud Network Security Engineer to design, secure, and automate network security capabilities across AWS primarily, with additional support for GCP. This role will focus on native cloud security controls, Palo Alto technologies, infrastructure as code, CI/CD enablement, and policy-driven guardrails that scale across cloud environments. The ideal candidate combines strong network security engineering fundamentals with hands-on cloud automation experience and a working understanding of how generative and agentic AI can improve security operations, engineering workflows, and risk reduction. Design, implement, and maintain network security architectures across AWS and GCP cloud environments. Configure and manage native CSP network security controls, including security groups, NACLs, firewalls, routing controls, private connectivity, segmentation, inspection, and logging capabilities. Deploy, integrate, and operate Palo Alto cloud network security platforms and related controls. Build and maintain reusable Terraform modules for secure cloud networking and security infrastructure. Use GitHub and GitHub Actions to support automated testing, validation, deployment, and lifecycle management of infrastructure and security controls. Promote CI/CD best practices, including code review, branch protection, automated checks, secrets management, environment promotion, and rollback strategies. Implement policy-as-code and infrastructure-as-code practices to enforce cloud security standards, compliance requirements, and architectural guardrails. Partner with cloud, platform, application, and security teams to embed secure networking patterns into standard engineering workflows. Develop automation to improve visibility, reduce manual operations, and accelerate secure cloud adoption. Evaluate and apply generative AI and agentic AI concepts to improve security engineering productivity, detection workflows, documentation, and operational decision support. Hands-on experience securing public cloud environments, with strong AWS expertise and working knowledge of GCP. Strong understanding of network security fundamentals, including routing, segmentation, firewalls, DNS, TLS, VPNs, private connectivity, ingress/egress controls, and traffic inspection. Experience with AWS-native network security services and controls; familiarity with equivalent GCP capabilities is preferred. Experience deploying or managing Palo Alto technologies in cloud or hybrid environments. Proficiency with Terraform and infrastructure-as-code design patterns. Experience using GitHub, GitHub Actions, and modern CI/CD pipelines for infrastructure or security automation. Familiarity with policy-as-code tools and concepts, such as automated compliance checks, guardrails, and pre-deployment validation. Ability to write clear technical documentation, reusable standards, and operational runbooks. Understanding of secure software delivery practices, secrets handling, least privilege, and automated testing. Foundational knowledge of generative AI, agentic AI, prompt engineering, model risks, AI-assisted engineering workflows, and responsible AI use in security contexts. Employment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.