Note: The job is a remote job and is open to candidates in USA. American Express Global Business Travel (Amex GBT) is hiring a Principal IAM AI Engineer to build identity architecture and security infrastructure for AI agents, copilots, and autonomous workflows. The role leads machine-identity governance, access controls, credential management, compliance alignment, and the engineering team responsible for these programs.

Responsibilities

• Deploy and automate identity controls at runtime for NHI identity — including immediate authentication verification, access authorization, and real-time rule application across the environment
• Build, deploy, and automate lifecycle governance for agents and machine identities — spanning discovery and registration, permission assignment, credential lifecycle, periodic access reviews, and secure retirement
• Construct and operationalize credential management systems for AI-driven applications and agents, encompassing automated secret cycling, short-lived credential issuance, and protected distribution to runtime environments
• Establish and implement fine-grained, zero-standing-privilege access models for agents and workloads, documented and managed through infrastructure-as-code and policy declaration frameworks
• Collaborate with application development and ML teams throughout all AI initiative phases, ensuring identity requirements, credential handling, and access controls are incorporated during design rather than retrofitted
• Facilitate implementation and adoption of identity governance controls for human users as required by organizational standards
• Work with compliance, risk and audit functions to confirm controls align with regulatory requirements and internal policies; facilitate audit evidence generation and regulatory reporting
• Lead an engineering team supporting these initiatives; establish technical direction, strategic priorities and delivery roadmap for machine identity and agent IAM programs

Skills

• Deep expertise in enterprise identity infrastructure: PAM (CyberArk or equivalent), Okta as IdP, and IGA platforms like Saviynt, including extending governance beyond human identities
• Strong AWS and cloud identity skills: IAM design, ephemeral credentials, OIDC federation, secrets/certificate management, and least-privilege at scale
• Mastery of core identity standards (OAuth, OIDC, SAML, SCIM, JWT, mTLS) and machine-to-machine/workload identity across on-prem, hybrid, and multi-cloud environments
• Proven ability to architect enterprise-scale identity security programs and govern non-human identities (inventory, ownership, certification, credential rotation, risk)
• Strong cross-functional leadership and communication skills, with sound judgment for operating in an emerging, still-being-defined discipline
• 8+ years in IAM/cybersecurity, with 5+ years at architect or principal level owning target-state design for an enterprise security or identity domain
• Proven experience designing identity, access, and governance controls for non-human identities — service accounts, workload identities, and AI agents — at enterprise scale
• Strong AWS (or equivalent public cloud) identity and access design experience at multi-account scale
• Hands-on experience with Okta (or comparable access management/federation platform) and Saviynt (or comparable IGA platform)
• Experience with privileged access management platforms such as Idira (formerly CyberArk) and HashiCorp Vault, or comparable tools
• Identity Threat Detection and Response (ITDR) and posture management Experience with SPIFFE/SPIRE or service mesh identity patterns
• Knowledge of emerging AI regulation and frameworks
• Externalized authorization and policy orchestration expertise
• Experience with Model Context Protocol (MCP) and agent-to-agent patterns
• Kubernetes and container security with workload identity
• Automation ability in Python, PowerShell or Terraform
• Relevant certifications: CISSP, CISM, CCSP, CyberArk, Okta, AWS Security, or architecture certifications

Benefits

• Discretionary annual bonus based on company and individual performance
• Health and welfare insurance plans
• Retirement programs
• Parental leave
• Adoption assistance
• Wellbeing resources to support the employee and immediate family
• Weekly travel deals from major travel providers on flights, hotels, cruises, and car rentals
• Access to over 20,000 courses on the learning platform
• Leadership courses
• New job openings available to internal candidates first
• Global Inclusion Groups

Company Overview

Company H1B Sponsorship