Associate-Technology Risk & Control

How will you make an impact in this role? The Global Risk & Compliance (GRC) organization serves as American Express’ independent risk management function. GRC maintains the enterprise risk framework, provides oversight and challenge, and monitors key risks. By embedding risk discipline into strategy and operations, GRC enables responsible growth, innovation, and long-term value creation while protecting customers and shareholders. The Technical Risk Management (TRM) team safeguards the enterprise, globally, by identifying, assessing, monitoring & reporting risks across Information & Cyber Security Risk, Technology Risk, Data Risk, Resiliency Risk, and AI Risk. Cybersecurity Risk Management (CRM) is a part of TRM and is responsible for the independent cybersecurity risk management across applications and infrastructure at American Express. CRM is hiring for an Associate who will support CRM in leading the governance, strategy and risk management for cybersecurity risks across American Express. This Associate will also assist with supporting cybersecurity committees and other forums. This Associate will report to the Cybersecurity Risk Management Manager and be part of the team that will manage cybersecurity risk frameworks and support core cyber domains, such as Third-party Security Management, Risk Exception/ Treatment and Cyber Resilience. Support the risk management oversight of Cybersecurity risk across core disciplines by leveraging technical expertise and AI, automation, and analytics. Assess information security risk management activities, including but not limited to security standards, control effectiveness, cybersecurity initiatives, and risk reporting. Identify potential risks and issues affecting the company and leveraging enterprise frameworks to record identified risks and issues. Support and coordinate executive risk reporting for areas such as: cybersecurity risk committees, internal and external audits, and broader enterprise risk initiatives. Monitor laws, rules, regulations and industry best practices related to cybersecurity risk. Minimum Qualifications: Bachelor's degree in business, cybersecurity, technology, or equivalent. Four years of risk management experience in cybersecurity or technology across one or more lines of defense. Experience within Cybersecurity or Technology disciplines, such as Third-party Risk Management, Exceptions Management, Vulnerability Management, Incident Management, Data Security, Identity and Access Management, or experience with Cybersecurity risk management policy development. Preferred Qualifications: Three years of experience in the financial services industry. Degree in Cybersecurity, Information Technology, Computer Science, Data Science, or equivalent. Cybersecurity, technology, or risk management certification (CISSP, CCSP, CEH, CISM, etc.) Experience with regulatory and industry technology or cybersecurity frameworks and guidance (CRI Sector Profile, NIST, FFIEC, COBIT)