Director, Cyber Defense & Incident Response

American Express Global Business Travel; Topeka (KS); On-site; USD 130,000 - 242,000; Full time

Benefits offered by this job

Flexible benefits

Travel perks

Learning and development

Job summary

Amex GBT is seeking a Director of Cyber Defense in the United States to lead CSIRT, CTI, Detection Engineering, and DSI. You will set strategy, oversee budgets, and coordinate with Legal, Privacy, HR, and executive leadership to protect travelers and data.

This hands-on leadership role requires 10+ years in cybersecurity with strong incident response experience, privacy knowledge, and the ability to drive metrics and cross‑functional collaboration at scale.

Qualifications

• 10+ years in cybersecurity, including 5+ years leading incident response, security operations, or a similar function.
• Direct experience running or overseeing sensitive investigations involving data privacy, insider risk, or employee conduct, ideally in partnership with Legal or HR.
• Working knowledge of threat intelligence practices and how intelligence should shape detection priorities.
• Experience with detection engineering concepts: SIEM/EDR content development, use case design, and frameworks like MITRE ATT&CK.
• A track record of leading through live incidents, including clear communication to non-technical executives under pressure.
• Familiarity with privacy and data protection regulations relevant to a global business (GDPR, CCPA).
• Experience managing managers and building teams, not just individual contributors.
• A bachelor's degree in a related field, or equivalent experience.

Responsibilities

• Lead and grow four connected teams — CSIRT, CTI, Detection Engineering, and DSI — as one cyber defense function with shared priorities and a common operating rhythm.
• Set the vision, roadmap, and budget for cyber defense capabilities, and report progress and risk to senior leadership.
• Hire, coach, and develop team leads and analysts; build a bench that can operate confidently during high‑pressure incidents.
• Define and track metrics that show real progress: dwell time, mean time to detect and respond, investigation closure rates, and intelligence coverage.
• Build strong working relationships with IT, Legal, Privacy, HR, Fraud, and business unit leaders.
• Own the incident response program end to end with playbooks, severity classification, escalation paths, and after-action reviews.
• Direct the collection, analysis, and distribution of threat intelligence relevant to our business and travelers.
• Set priorities for detection content development across SIEM, EDR, cloud, and identity systems.

Skills

Cyber defense leadership

Incident response leadership

Threat intelligence

Detection engineering

Data privacy investigations

Stakeholder communication

Team management

Education

Bachelor's degree in related field

Tools

SIEM

EDR

Threat intelligence platforms

Job description

Amex GBT is seeking a Director of Cyber Defense in the United States to lead CSIRT, CTI, Detection Engineering, and DSI. You will set strategy, oversee budgets, and coordinate with Legal, Privacy, HR, and executive leadership to protect travelers and data.

This hands-on leadership role requires 10+ years in cybersecurity with strong incident response experience, privacy knowledge, and the ability to drive metrics and cross‑functional collaboration at scale.