Manager, IT Cybersecurity Governance, Risk & Compliance

American Airlines; Fort Worth (TX); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Travel perks

Health benefits

Wellness programs

401(k) program

Discounts on travel

Job summary

American Airlines is building a more reliable, profitable airline through digital excellence. In this onsite Fort Worth, TX role, you will lead a specialized cybersecurity governance, risk, and compliance (GRC) team to translate complex cyber risk into risk-informed decisions across technology, applications, and third parties.

You will combine risk methodology, data analytics, and GRC platform engineering to improve how cyber risk is measured, prioritized, and managed.

Qualifications

• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Business, Risk Management, Compliance, Audit, or related discipline, or equivalent experience/training.
• Experience delivering and leading cybersecurity, IT risk management, compliance, audit, governance, or related activities.
• Experience evolving cybersecurity risk methodologies and analytical approaches using threat, exposure, control effectiveness, and business context.
• Strong knowledge of cybersecurity risk management, including inherent and residual risk, risk scoring and prioritization, risk treatment and acceptance, risk appetite and tolerance, and risk/control frameworks.
• Strong understanding of risk and control management, including risk/control libraries, control effectiveness, issues and exceptions, risk acceptance, and remediation governance.
• Experience with third-party risk management such as supplier risk assessments, due diligence, control reviews, issue remediation, ongoing monitoring, and aligning third-party cyber risk requirements to enterprise expectations.
• Strong understanding of risk metrics, analytics, and data, including translating cyber/control/risk data into decision-support indicators and trends.
• Experience integrating or leveraging data across GRC platforms, enterprise data environments or data lakes, security platforms, and reporting or visualization tools.
• Experience with GRC platform engineering and enablement, including data models, integrations, workflows, automation, and reporting. Experience with Archer, ServiceNow GRC/IRM, OneTrust, or similar technologies is preferred.
• Working knowledge of frameworks like NIST CSF, NIST RMF, ISO 27001/27005, and related industry standards.
• Leadership, communication, and stakeholder-management experience leading specialized teams and influencing decisions across Cybersecurity, Technology, enterprise risk, and business functions.
• Ability to translate complex technical risks and data into clear business risk insights for senior leaders and nontechnical stakeholders.

Responsibilities

• Lead or support governance, risk, and compliance activities within assigned areas, ensuring alignment to enterprise risk and regulatory requirements.
• Lead, coach, and develop team members supporting cybersecurity GRC functions by setting expectations and driving consistent execution.
• Provide management oversight for tools, processes, reporting, and capabilities supporting policy management, risk assessment, third-party risk, control assurance, compliance tracking, remediation governance, and leadership visibility.
• Support development, maintenance, communication, and adoption of cybersecurity policies, standards, and control expectations to promote clear ownership and consistent security practices.
• Lead or support risk and control work including identifying gaps, assessing impact, supporting risk decisions, and tracking remediation progress.
• Drive readiness activities related to cybersecurity compliance obligations, including audits, assessments, evidence collection, issue management, and fulfillment of regulatory requirements.
• Partner with Cybersecurity, Technology, Legal, Audit, Privacy, Compliance, and business teams to align expectations and support risk-informed decisions.
• Prepare and communicate outcome-focused reporting covering risk, compliance, control performance, audit findings, remediation progress, and key decisions for leadership and stakeholders.
• Identify improvements to processes, controls, documentation, metrics, and operating practices to strengthen transparency and program maturity.

Skills

GRC governance

risk management

compliance

data analytics

platform engineering

policy management

risk assessment

third-party risk

control assurance

compliance tracking

remediation governance

leadership

stakeholder management

Education

Bachelor’s degree

Tools

Archer

ServiceNow GRC/IRM

OneTrust

NIST CSF

NIST RMF

ISO 27001

ISO 27005

PCI DSS

SOX

SOC 2

CMMC

GDPR

Job description

American Airlines is building a more reliable, profitable airline through digital excellence. In this onsite role in Fort Worth, TX, you will lead a specialized cybersecurity governance, risk, and compliance (GRC) team, helping translate complex cyber risk into risk-informed decisions across technology, applications, and third parties. You will combine risk methodology, data and analytics, and GRC platform engineering to improve how cyber risk is measured, prioritized, and managed.

What you’ll do

• Lead or support governance, risk, and compliance activities within assigned areas, ensuring expectations are practical and aligned to enterprise risk and regulatory requirements.
• Lead, coach, and develop team members supporting cybersecurity GRC functions by setting clear expectations, strengthening accountability, and driving consistent execution.
• Provide management oversight for tools, processes, reporting, and capabilities supporting areas such as policy management, risk assessment, third-party risk management, control assurance, compliance tracking, remediation governance, and leadership visibility.
• Support the development, maintenance, communication, and adoption of cybersecurity policies, standards, and control expectations to promote clear ownership and consistent security practices.
• Lead or support risk and control work including identifying gaps, assessing impact, supporting risk decisions, and tracking remediation progress.
• Drive readiness activities related to cybersecurity compliance obligations, including audits, assessments, evidence collection, issue management, and fulfillment of applicable regulatory and industry requirements.
• Partner with Cybersecurity, Technology, Legal, Audit, Privacy, Compliance, and business teams to align expectations, resolve issues, and support risk-informed decisions.
• Prepare and communicate outcome-focused reporting covering risk, compliance, control performance, audit findings, remediation progress, and key decisions for leadership and stakeholders.
• Identify improvements to processes, controls, documentation, metrics, and operating practices to strengthen transparency, consistency, accountability, and program maturity.

What you bring

• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Business, Risk Management, Compliance, Audit, or a related discipline, or equivalent experience/training.
• Experience delivering and leading cybersecurity, information technology, risk management, compliance, audit, governance, or related activities.
• Experience evolving cybersecurity risk methodologies and analytical approaches using threat, exposure, control effectiveness, and business context.
• Strong knowledge of cybersecurity risk management, including inherent and residual risk, risk scoring and prioritization, risk treatment and acceptance, risk appetite and tolerance, and risk and control frameworks.
• Strong understanding of risk and control management, including risk/control libraries, control effectiveness, issues and exceptions, risk acceptance, and remediation governance.
• Experience with third-party risk management such as supplier risk assessments, due diligence, control reviews, issue remediation, ongoing monitoring, and aligning third-party cyber risk requirements to enterprise expectations.
• Strong understanding of risk metrics, analytics, and data, including translating cyber/control/risk data into decision-support indicators and trends.
• Experience integrating or leveraging data across GRC platforms, enterprise data environments or data lakes, security platforms, and reporting or visualization tools.
• Experience with GRC platform engineering and enablement, including data models, integrations, workflows, automation, and reporting. Experience with Archer, ServiceNow GRC/IRM, OneTrust, or similar technologies is preferred.
• Working knowledge of established frameworks such as NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF), ISO 27001/27005, and other relevant industry frameworks.
• Leadership, communication, and stakeholder-management experience leading specialized teams and influencing decisions across Cybersecurity, Technology, enterprise risk, and business functions.
• Ability to translate complex technical risks and data into clear business risk insights and recommendations for senior leaders and nontechnical stakeholders.
• Ability to set strategic direction, define capability roadmaps, prioritize work, and align cyber products and services to enterprise risk, regulatory, and business objectives.
• Experience building, coaching, and developing high-performing teams with strong accountability and delivery across multiple workstreams.

Tools and frameworks you may use

Archer, ServiceNow GRC/IRM, OneTrust, NIST CSF, NIST RMF, ISO 27001, ISO 27005, PCI DSS, SOX, SOC 2, CMMC, GDPR.

Benefits

• Travel perks: reach 365 destinations on more than 6,800 daily flights across the global network.
• Health benefits: access to health, dental, prescription and vision benefits; virtual doctor visits; flexible spending accounts.
• Wellness programs.
• 401(k) program (available upon hire; depending on workgroup, employer contributions after one year).
• Additional benefits: Member Assistance Program, pet insurance, discounts on hotels, cars, cruises and more.

Inclusion at American

Inclusion and diversity are the foundation of the dynamic workforce at American Airlines. The organization also has 20+ Team Member Resource Groups focused on connecting team members to customers, suppliers, communities, and shareholders.