Director, Cyber Defense: Global Incident Response Leader

American Express Global Business Travel; Honolulu (HI); On-site; USD 130,000 - 242,000; Full time

Job summary

American Express Global Travel is seeking a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. This role sets strategy, roadway, and budget for cyber defenses across a global business, partnering with Legal, Privacy, HR, and executive leadership.

The position requires 10+ years in cybersecurity with leadership in IR or security operations, strong incident command experience, and collaboration across functions.

Qualifications

• 10+ years in cybersecurity with leadership in IR or security ops.
• Experience running sensitive investigations involving data privacy, insider risk, or employee conduct.
• Bachelor's degree or equivalent; security certifications preferred.

Responsibilities

• Lead four teams: CSIRT, CTI, Detection Engineering, and DSI as a unified cyber defense function.
• Set strategy, roadmap, and budgets for cyber defense and report to senior leadership.
• Hire, coach, and develop team leads and analysts; build a bench for high‑pressure incidents.
• Define metrics like dwell time, mean time to detect and respond, investigation closure rates, and intelligence coverage.
• Collaborate with IT, Legal, Privacy, HR, Fraud, and business unit leaders.

Skills

Cybersecurity leadership

Incident response leadership

Threat intelligence

Detection engineering

Data security investigations

Cross-functional collaboration

Education

Bachelor's degree or equivalent

Tools

SIEM

EDR

Cloud security tools

Job description

American Express Global Travel is seeking a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. This role sets strategy, roadway, and budget for cyber defenses across a global business, partnering with Legal, Privacy, HR, and executive leadership.

The position requires 10+ years in cybersecurity with leadership in IR or security operations, strong incident command experience, and collaboration across functions.