Director, Cyber Defense & Incident Response

American Express Global Business Travel; Harrisburg (Dauphin County); On-site; USD 130,000 - 242,000; Full time

Benefits offered by this job

Flexible benefits

Travel perks

Learning platform access

Inclusion Groups

Job summary

Amex GBT is seeking a Director, Cyber Defense in the United States to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. This leader will set strategy for detection, investigation, and incident response across a global business, partnering with Legal, Privacy, HR, and executives on data-sensitive incidents.

The role emphasizes hands-on leadership, scaling security operations, and building programs that stay ahead of threats, with collaboration across IT and business units.

Qualifications

• 10+ years in cybersecurity, incl. 5+ years leading incident response or security operations
• Experience supervising sensitive investigations with Legal or HR
• Knowledge of threat intel practices shaping detection priorities

Responsibilities

• Lead four cyber defense teams (CSIRT, CTI, Detection Eng., DSI) with a unified strategy
• Own the incident response program end-to-end and act as incident commander as needed
• Direct threat intelligence collection and distribution to inform detection priorities
• Drive detection content development across SIEM/EDR/cloud/identity to reduce false positives

Skills

Cybersecurity leadership

Incident response

Threat intelligence

Detection engineering

Data privacy investigations

Education

Bachelor's degree in a related field

Tools

SIEM/EDR platforms

Threat intelligence platforms

Job description

Amex GBT is seeking a Director, Cyber Defense in the United States to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. This leader will set strategy for detection, investigation, and incident response across a global business, partnering with Legal, Privacy, HR, and executives on data-sensitive incidents.

The role emphasizes hands-on leadership, scaling security operations, and building programs that stay ahead of threats, with collaboration across IT and business units.