Director, Cyber Defense & Incident Response

American Express Global Business Travel; Lincoln (NE); On-site; USD 130,000 - 242,000; Full time

Benefits offered by this job

Travel perks

Flexible benefits

Professional development courses

Job summary

Amex GBT seeks a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. This hands-on leadership role shapes how we detect, investigate, and respond to security incidents and data-handling concerns across a global business.

You will partner with Legal, Privacy, HR, and executive leadership to protect travelers, colleagues, and data. The role involves setting strategy, budget, and metrics, with a focus on proactive defense and resilience.

Qualifications

• 10+ years in cybersecurity, including 5+ years leading incident response, security operations, or a similar function.
• Direct experience running or overseeing sensitive investigations involving data privacy, insider risk, or employee conduct, ideally in partnership with Legal or HR.
• Working knowledge of threat intelligence practices and how intelligence should shape detection priorities.
• Experience with detection engineering concepts: SIEM/EDR content development, use case design, and frameworks like MITRE ATT&CK.
• A track record of leading through live incidents, including clear communication to non-technical executives under pressure.
• Familiarity with privacy and data protection regulations relevant to a global business (e.g. GDPR, CCPA).
• Experience managing managers and building teams, not just individual contributors.
• A bachelor's degree in a related field, or equivalent experience

Responsibilities

• Lead and grow four connected teams — CSIRT, CTI, Detection Engineering, and DSI — as one cyber defense function with shared priorities and a common operating rhythm
• Set vision, roadmap, and budget for cyber defense capabilities, and report progress and risk to senior leadership
• Hire, coach, and develop team leads and analysts; build a bench that can operate confidently during high-pressure incidents
• Define and track metrics that show real progress: dwell time, mean time to detect and respond, investigation closure rates, and intelligence coverage
• Build strong working relationships with IT, Legal, Privacy, HR, Fraud, and business unit leaders
• Own the incident response program end to end: playbooks, severity classification, escalation paths, and after-action reviews

Skills

Cybersecurity leadership

Incident response

Threat intelligence

Detection engineering

Data privacy experience

Executive communication

Team management

Bachelor's degree in related field

Education

Bachelor's degree in a related field

Job description

Amex GBT seeks a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. This hands-on leadership role shapes how we detect, investigate, and respond to security incidents and data-handling concerns across a global business.

You will partner with Legal, Privacy, HR, and executive leadership to protect travelers, colleagues, and data. The role involves setting strategy, budget, and metrics, with a focus on proactive defense and resilience.