Chief Cyber Defense & Incident Response

American Express Global Business Travel; Olympia (WA); On-site; USD 130,000 - 242,000; Full time

Benefits offered by this job

Flexible benefits

Travel perks

Skills development

Inclusion initiatives

Job summary

Amex GBT in the United States is seeking a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. You will set the vision for threat detection, incident response, and intelligence programs across a global business.

The role requires 10+ years in cybersecurity with 5+ years in leadership, plus experience handling sensitive investigations and regulatory considerations. This is a senior, global leadership position.

Qualifications

• Bachelor's degree or equivalent in a related field
• 10+ years in cybersecurity, including 5+ years in leadership of IR/security operations
• Experience running sensitive investigations involving data privacy or insider risk
• Knowledge of threat intelligence practices and how it shapes detection priorities
• Experience with SIEM/EDR content development and MITRE ATT&CK framework

Responsibilities

• Lead four connected teams (CSIRT, CTI, Detection Eng, DSI) as a unified cyber defense function
• Set vision, roadmap, and budget for cyber defense capabilities, reporting to senior leadership
• Hire, coach, and develop team leads and analysts for high-pressure incidents
• Own end-to-end incident response program, including playbooks, escalation, and after-action reviews
• Direct collection and distribution of threat intelligence and translate into detection improvements

Skills

Leadership experience

Incident response

Threat intelligence

MITRE ATT&CK

Education

Bachelor's degree or equivalent

Tools

SIEM/EDR platforms

Threat intel tools

Job description

Amex GBT in the United States is seeking a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. You will set the vision for threat detection, incident response, and intelligence programs across a global business.

The role requires 10+ years in cybersecurity with 5+ years in leadership, plus experience handling sensitive investigations and regulatory considerations. This is a senior, global leadership position.