Director, Cyber Defense — Lead Global Incident Response

American Express Global Business Travel; Cheyenne (WY); On-site; USD 130,000 - 242,000; Full time

Job summary

American Express Global Business Travel is seeking a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. This role shapes strategy, budgets, and incident response at scale, partnering with Legal, Privacy, HR, and executive leadership to protect travelers and data.

The ideal candidate will drive proactive defense, oversee live incidents, and translate threat intelligence into actionable detection priorities across global teams.

Qualifications

• 10+ years in cybersecurity, incl. 5+ years leading incident response or security operations
• Direct experience overseeing sensitive investigations with Legal/HR
• Working knowledge of threat intelligence practices and how intel shapes detection
• Experience with detection engineering: SIEM/EDR content development & use cases
• Proven track record leading through live incidents and communicating to executives
• Familiarity with privacy/data protection regulations (GDPR, CCPA) for global business
• Experience managing managers and building teams, not just individual contributors
• Bachelor's degree in a related field or equivalent experience

Responsibilities

• Lead four teams (CSIRT, CTI, Detection Engineering, DSI) as a single cyber defense function
• Set vision, roadmap, and budget for cyber defense capabilities and report progress to leadership
• Hire, coach, and develop team leads and analysts; build a capable bench
• Define and track metrics: dwell time, MTTD/MTTR, closure rates, intel coverage
• Build strong relationships with IT, Legal, Privacy, HR, Fraud, and business leaders
• Own the incident response program end to end: playbooks, escalation, after-action reviews
• Direct threat intelligence collection, analysis, and distribution relevant to the business
• Drive detection content development across SIEM/EDR/cloud/identity environments
• Lead investigations into data access/disclosure and coordinate with Legal/Privacy/HR

Skills

Team leadership

Strategic planning

Executive communication

Incident management under pressure

Cross-functional collaboration

Security operations

Education

Bachelor's degree or equivalent

CISSP

GCIH

GCFA

GCTI

Tools

SIEM

EDR

MITRE ATT&CK

Threat intelligence platforms

Job description

American Express Global Business Travel is seeking a Director, Cyber Defense to lead CSIRT, CTI, Detection Engineering, and Data Security Investigations. This role shapes strategy, budgets, and incident response at scale, partnering with Legal, Privacy, HR, and executive leadership to protect travelers and data.

The ideal candidate will drive proactive defense, oversee live incidents, and translate threat intelligence into actionable detection priorities across global teams.