Senior Associate - Vulnerability Remediation Management Specialist

Joining Amex Tech means discovering and shaping your contribution to something big. Here, you can work alongside talented tech teams and build a unique career with the Powerful Backing of American Express. With a range of opportunities to work with the latest technologies, and a commitment to back the broader engineering community through open source, our mission is to power your success. Because Amex Tech is powered by our technology, our culture, and our colleagues.

The Technology organization enables and accelerates the company’s growth strategies, delivering global capabilities and services in support of Amex’s customers and colleagues, while maintaining 24/7 servicing and availability to ensure an uninterrupted, high-quality customer experience. Technology provides the foundation for everything we do in the company while driving differentiation through building and leveraging innovative technology and data insights.

At American Express, our mission is to deliver the world’s best customer experience every day. At the heart of this mission is our Information Security organization, enabling exceptional experiences built on a foundation of trust, service, and security. We leverage advanced technologies and data-driven insights to stay ahead of an evolving threat landscape. We foster a culture of passion, curiosity, and courage—empowering you to innovate, grow, and help shape the future of a Fortune 100 company.

Trust. Service. Security.

We are looking for a Senior Associate-Vulnerability Remediation Management Specialist to join the Remediation team within the Penetration Testing function. The role will focus on managing the end-to-end vulnerability lifecycle, coordinating remediation activities, assessing security risks, performing vulnerability retesting, and managing Bug Bounty and Responsible Disclosure Programs.

• Vulnerability Management: Track and manage vulnerabilities identified through penetration testing, Bug Bounty, and Responsible Disclosure Programs.
• Risk Assessment: Evaluate and prioritize vulnerabilities based on severity, exploitability, and business impact.
• Remediation Coordination: Communicate security findings and remediation recommendations to development teams, ensuring timely resolution within defined SLAs.
• Vulnerability Retesting: Validate remediation fixes through technical retesting and maintain closure evidence.
• Bug Bounty & Responsible Disclosure: Manage vulnerability submissions, coordinate validation and remediation, and communicate with external security researchers.
• Reporting & Governance: Maintain vulnerability dashboards, track remediation metrics, and provide regular status updates to stakeholders.

Required Skills

• Basic understanding of penetration testing methodologies and OWASP Top 10 vulnerabilities.
• Knowledge of vulnerability management, risk assessment, and CVSS scoring.
• Familiarity with security testing tools such as Burp Suite, Nmap, and OWASP ZAP.
• Experience with vulnerability tracking tools such as Jira or ServiceNow.
• Understanding of Bug Bounty and Responsible Disclosure processes.
• Strong communication, analytical, and stakeholder management skills.

Preferred Experience

• 3–6 years of experience in cybersecurity, penetration testing, application security, or vulnerability management.
• Hands-on experience in vulnerability validation, remediation tracking, and retesting.
• Certifications such as CEH, eJPT, or CompTIA Security+ are an advantage.

Role Focus: This is primarily a vulnerability management and remediation coordination role requiring foundational penetration testing knowledge, technical validation capabilities, and strong stakeholder management skills.

Employment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.