Chief Cyber Defense & Incident Response

American Express Global Business Travel; Des Moines (IA); On-site; USD 130,000 - 242,000; Full time

Job summary

Amex Global Business Travel is seeking a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. You will set strategy for detecting, investigating, and responding to security incidents and data handling concerns across a global business.

In this hands-on leadership role, you’ll partner with Legal, Privacy, HR, and executive leadership, building a high-performing team and defining metrics to measure dwell time, detection, and intelligence coverage.

Qualifications

• 10+ years in cybersecurity, including 5+ years leading incident response, security operations, or a similar function.
• Direct experience running or overseeing sensitive investigations involving data privacy, insider risk, or employee conduct, ideally with Legal or HR.
• Working knowledge of threat intelligence practices and how intelligence should shape detection priorities.
• Experience with detection engineering concepts: SIEM/EDR content development, use case design, and frameworks like MITRE ATT&CK.
• A track record of leading through live incidents, including clear communication to non-technical executives under pressure.
• A bachelor's degree in a related field, or equivalent experience

Responsibilities

• Lead and grow four connected teams — CSIRT, CTI, Detection Engineering, and DSI — as one cyber defense function with shared priorities and a common operating rhythm
• Set the vision, roadmap, and budget for cyber defense capabilities, and report progress and risk to senior leadership
• Hire, coach, and develop team leads and analysts; build a bench that can operate confidently during high-pressure incidents
• Define and track metrics that show real progress: dwell time, mean time to detect and respond, investigation closure rates, and intelligence coverage
• Build strong working relationships with IT, Legal, Privacy, HR, Fraud, and business unit leaders
• Own the incident response program end to end: playbooks, severity classification, escalation paths, and after-action reviews
• Act as incident commander (or oversee the commander on rotation) for major security incidents, coordinating technical response with clear communication to executives
• Run regular tabletop exercises and simulations to test readiness across the company
• Direct the collection, analysis, and distribution of threat intelligence relevant to our business, our sector, and our travelers
• Turn intelligence into action: feed indicators and adversary tradecraft directly into detection content and hunting priorities
• Represent us in relevant intelligence-sharing communities and industry groups
• Set priorities for detection content development across SIEM, EDR, cloud, and identity systems
• Drive continuous tuning to cut down false positives while closing coverage gaps
• Champion automation and orchestration so the team spends time on judgment calls
• Lead investigations into potential inappropriate access, use, or disclosure of sensitive data

Skills

Cybersecurity leadership

Incident response

Education

Bachelor's degree in a related field

Job description

Amex Global Business Travel is seeking a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. You will set strategy for detecting, investigating, and responding to security incidents and data handling concerns across a global business.

In this hands-on leadership role, you’ll partner with Legal, Privacy, HR, and executive leadership, building a high-performing team and defining metrics to measure dwell time, detection, and intelligence coverage.