Manager, IT Cybersecurity Governance, Risk & Compliance

Fly.AA; Fort Worth (TX); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Travel Perks

Health Benefits

Wellness Programs

401(k) Program

Additional Benefits

Job summary

American Airlines is seeking a Manager, IT Cybersecurity Governance, Risk & Compliance to lead a specialized team responsible for measuring, prioritizing, and managing cyber risk across technology, applications, and third parties.

You will advance risk metrics, integrate data across GRC platforms, and evolve reporting to scale risk management as threats and priorities change. The role emphasizes leadership, governance, and executive reporting.

Qualifications

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Business, Risk Management, Compliance, Audit, or related discipline, or equivalent experience/training.
• Experience delivering and leading cybersecurity, information technology, risk management, compliance, audit, governance, or related activities.

Responsibilities

• Lead or support governance, risk, compliance, and control-related activities within assigned areas.
• Lead, coach, and develop team members supporting cybersecurity GRC functions.
• Provide management oversight for tools, processes, reporting, and capabilities supporting policy management, risk assessment, third party risk, control assurance, and remediation governance.
• Support development, maintenance, communication, and adoption of cybersecurity policies, standards, and control expectations.
• Lead or support risk and control activities, including identifying gaps, assessing impact, and tracking remediation.
• Lead or support activities related to cybersecurity compliance obligations, audits, assessments, and readiness for regulatory and industry requirements.
• Partner with Cybersecurity, Technology, Legal, Audit, Privacy, Compliance, and business teams to align expectations and drive accountability.
• Prepare and communicate clear reporting on risk, compliance, controls, audits, remediation progress, and key decisions.
• Identify opportunities to improve processes, controls, documentation, metrics, and operating practices to strengthen cybersecurity maturity.

Skills

Cybersecurity risk management

Leadership

Stakeholder management

GRC

Regulatory compliance

Data analytics

Communication

Education

Bachelor's degree in Cybersecurity/Information Security

Tools

Archer

ServiceNow GRC/IRM

OneTrust

Job description

Manager, IT Cybersecurity Governance, Risk & Compliance View Profile

Need Accommodation Assistance?

• Careers
• Student & Grads
• Life at American
• Our People

Manager, IT Cybersecurity Governance, Risk & Compliance Posting Start Date: 11/6/26

Location: DFW Reservations Office (DFW-SV01)
Cities: Fort Worth - TX
Requisition ID: 88975

Job Description

Intro

Are you ready to explore a world of possibilities, both at work and during your time off? Join our American Airlines family, and you’ll travel the world, grow your expertise and become the best version of you. As you embark on a new journey, you’ll tackle challenges with flexibility and grace, learning new skills and advancing your career while having the time of your life. Feel free to enrich both your personal and work life and hop on board!

Why you'll love this job

• As one diverse, high-performing team dedicated to technical excellence, you will focus relentlessly on delivering unrivaled digital products that drive a more reliable and profitable airline.
• As a Cybersecurity GRC Manager, you will lead a specialized team shaping how American measures, prioritizes, and manages cyber risk across technology, applications, and third parties. You’ll bring together risk methodology, data and analytics, and GRC platform engineering to turn complex risk information into actionable insights and better-informed business decisions. You’ll advance risk metrics and enterprise data integration while evolving GRC platforms, workflows, automation, and reporting to scale risk management as threats, technology, and business priorities change.

What you'll do

As noted above, this list is intended to reflect the current job but there may be additional essential functions (and certainly non-essential job functions) that are not referenced. Management will modify the job or require other tasks be performed whenever itis deemed appropriate to do so, observing, of course, any legal obligations including any collective bargaining obligations.

• Support Cybersecurity GRC Capabilities: Lead or support governance, risk, compliance, and control-related activities within assigned areas, helping ensure expectations are clear, practical, and aligned to enterprise risk and regulatory requirements.
• Lead and Develop Teams: Lead, coach, and develop team members supporting assigned cybersecurity GRC functions; set clear expectations, strengthen accountability, and foster consistent execution across priorities.
• Oversee Assigned GRC Processes and Capabilities: Provide management oversight for assigned tools, processes, reporting, and capabilities that support areas such as policy management, risk assessment, third party risk management, control assurance, compliance tracking, remediation governance, or leadership visibility.
• Support Policy, Standards, and Control Governance: Support the development, maintenance, communication, and adoption of cybersecurity policies, standards, and control expectations within assigned areas to promote clear ownership and consistent security practices.
• Manage Risk and Control Activities: Lead or support risk and control activities within assigned responsibilities, including identifying gaps, assessing impact, supporting risk decisions, and tracking remediation progress.
• Support Compliance and Regulatory Activities: Lead or support activities related to cybersecurity compliance obligations, audits, assessments, evidence collection, issue management, and readiness for applicable regulatory and industry requirements.
• Partner Across Stakeholder Groups: Partner with Cybersecurity, Technology, Legal, Audit, Privacy, Compliance, and business teams to align expectations, resolve issues, support risk-informed decisions, and drive accountability for assigned actions.
• Deliver Clear Risk and Compliance Reporting: Prepare and communicate clear, outcome-focused reporting within assigned areas, including risk, compliance, control performance, audit findings, remediation progress, and key decisions for leadership and stakeholders.
• Improve GRC Practices and Execution: Identify opportunities to improve assigned processes, controls, documentation, metrics, and operating practices to strengthen transparency, consistency, accountability, and cybersecurity program maturity.

All you'll need for success

Minimum Qualifications – Education & Prior Job Experience

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Business, Risk Management, Compliance, Audit, or a related discipline, or equivalent experience/training.
• Experience delivering and leading cybersecurity, information technology, risk management, compliance, audit, governance, or related activities.

Preferred Qualifications – Education & Prior Job Experience

• Bachelor's degree in Information Security, Computer Science, or a related field; advanced degree preferred
• 6+ years of experience in cybersecurity, information technology, risk management, compliance, audit, governance, or a closely related field preferred, and 3+ years of leadership experience
• Experience leading cybersecurity governance, risk management, compliance, control management, or related enterprise programs, including setting priorities, defining outcomes, and improving program maturity.
• Experience overseeing security audits, assessments, control assurance activities, remediation governance, and executive reporting to ensure clear ownership, accountability, and timely risk reduction.
• Experience applying regulatory, risk, compliance, and control frameworks such as NIST, ISO 27001, PCI DSS, SOX, SOC 2, CMMC, GDPR, or similar standards to guide strategy, prioritization, governance, and leadership decision-making.

All you’ll need for success (continued....)

Skills, Licenses, and Certifications

• Experience evolving cybersecurity risk methodologies and analytical approaches to incorporate threat, exposure, control effectiveness, and business context into risk assessment and prioritization.
• Strong knowledge of cybersecurity risk management, including risk identification and analysis, inherent and residual risk, risk scoring and prioritization, risk treatment and acceptance, risk appetite and tolerance, and risk and control frameworks.
• Strong understanding of risk and control management, including risk and control libraries, control effectiveness, issues and exceptions, risk acceptance, and remediation governance.
• Experience with third-party risk management practices, including supplier risk assessments, due diligence, control reviews, issue remediation, ongoing monitoring, and alignment of third-party cyber risk requirements to enterprise risk and compliance expectations.
• Strong understanding of risk metrics, analytics, and data, with experience translating cybersecurity, control, and risk data into meaningful indicators, trends, and decision-support for leadership.
• Experience integrating or leveraging data across GRC platforms, enterprise data environments/data lakes, security platforms, and reporting or visualization tools to improve risk measurement and insights.
• Experience with GRC platform engineering and enablement, including data models, integrations, workflows, automation, reporting, and platform evolution. Experience with platforms such as Archer, ServiceNow GRC/IRM, OneTrust, or similar technologies is preferred.
• Working knowledge of established cybersecurity and risk frameworks, such as NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF), ISO 27001/27005, and other relevant industry frameworks.
• Strong leadership, communication, and stakeholder-management skills, with experience leading specialized teams and influencing decisions across Cybersecurity, Technology, enterprise risk, and business functions.
• Relevant professional certification such as CISSP, CRISC, CISM, or equivalent is preferred.
• Demonstrated ability to translate complex technical risks and data into clear business risk insights and recommendations for senior leaders and nontechnical stakeholders.
• Demonstrated ability to lead cross-functional teams and influence senior stakeholders across cybersecurity, technology, finance, legal, audit, privacy, compliance, and business teams, with strong judgement and executive presence to navigate ambiguity, drive alignment, and accelerate material risk decisions appropriately.
• Ability to set strategic direction, define capability roadmaps, prioritize work, and align cyber products and services to enterprise risk, regulatory, and business objectives.
• Experience building, coaching, and developing high-performing teams, including setting expectations, strengthening accountability, and improving delivery across multiple workstreams.

What you’ll get

Feel free to take advantage of all that American Airlines has to offer:

• Travel Perks: Ready to explore the world? You, your family and your friends can reach 365 destinations on more than 6,800 daily flights across our global network.
• Health Benefits: On day one, you’ll have access to your health, dental, prescription and vision benefits to help you stay well. And that’s just the start, we also offer virtual doctor visits, flexible spending accounts and more.
• Wellness Programs: We want you to be the best version of yourself – that’s why our wellness programs provide you with all the right tools, resources and support you need.
• 401(k) Program: Available upon hire and, depending on the workgroup, employer contributions to your 401(k) program are available after one year.
• Additional Benefits: Other great benefits include our Member Assistance Program, pet insurance and discounts on hotels, cars, cruises and more

Feel free to be yourself at American

From the team members we hire to the customers we serve, inclusion and diversity are the foundation of the dynamic workforce at American Airlines. Our 20+ Team Member Resource Groups are focused on connecting our team members to our customers, suppliers, communities and shareholders, helping team members reach their full potential and creating an inclusive work environment to meet and exceed the needs of our diverse world.
Are you ready to feel a tremendous sense of pride and satisfaction as you do your part to keep the largest airline in the world running smoothly as we care for people on life’s journey? Feel free to be yourself at American.

Cities:Fort Worth - TX
Requisition ID:88975

Discrimination and all unlawful harassment (including sexual harassment) in employment is not tolerated. We encourage success based on our individual merits and abilities without regard to race, color, religion, national origin, gender, sexual orientation, gender identity, age, disability, marital status, citizenship status, military status, protected veteran status or employment status. We support and obey laws that prohibit discrimination everywhere we do business. American Airlines, Inc fully considers all qualified applicants including those with a criminal history. ©2025, American Airlines, Inc. We are excited you're interested in beginning your career journey with us. All applications will only be submitted through this site, and we will never require payment at any time during the application process.