Director, Cyber Defense & Incident Response

American Express Global Business Travel; Springfield (IL); On-site; USD 130,000 - 242,000; Full time

Job summary

Amex GBT is seeking a Director of Cyber Defense to lead CSIRT, CTI, Detection Engineering, and DSI, establishing strategy and a unified operating rhythm across a global business. This role partners with Legal, Privacy, HR and executive leadership to protect traveler and colleague data and maintain trust.

You will define the program roadmaps, budgets, and success metrics, while coaching leaders and analysts to perform under pressure during critical incidents.

Qualifications

• 10+ years in cybersecurity with 5+ years leading incident response, security operations, or a similar function.
• Experience leading sensitive investigations involving data privacy, insider risk, or employee conduct, ideally with Legal or HR.
• Strong threat intelligence practices shaping detection priorities and operational decisions.

Responsibilities

• Lead and grow four connected teams—CSIRT, CTI, Detection Engineering, and DSI—as one cyber defense function with a shared operating rhythm.
• Set the vision, roadmap, and budget for cyber defense capabilities, and report progress and risk to senior leadership.
• Hire, coach, and develop team leads and analysts; build a bench that can operate confidently during high‑pressure incidents.
• Define and track metrics such as dwell time, mean time to detect and respond, investigation closure rates, and intelligence coverage.
• Own the incident response program end to end; act as incident commander for major security incidents and coordinate technically with executives.
• Direct collection and distribution of threat intelligence; turn intel into actionable detection content and hunting priorities.
• Set priorities for detection content development across SIEM, EDR, cloud, and identity systems; drive continuous tuning to reduce false positives.
• Partner with CTI and CSIRT to ensure intel improves detection and response.

Skills

Cybersecurity leadership

Incident response management

Threat intelligence

Detection engineering

Data security investigations

Cross-functional collaboration

Executive communication

Education

Bachelor's degree or equivalent experience

Tools

SIEM/EDR platforms

Job description

Amex GBT is seeking a Director of Cyber Defense to lead CSIRT, CTI, Detection Engineering, and DSI, establishing strategy and a unified operating rhythm across a global business. This role partners with Legal, Privacy, HR and executive leadership to protect traveler and colleague data and maintain trust.

You will define the program roadmaps, budgets, and success metrics, while coaching leaders and analysts to perform under pressure during critical incidents.