Senior Third-Party Cyber Risk & Governance Lead

American Express; Boston (MA); Remote; USD 27,552 - 41,328; Full time

Job summary

American Express seeks an experienced Senior Information Security Manager to partner with leadership on a robust third‑party cyber risk program. The role will design, implement, and maintain controls across global operations, ensuring compliance with internal policies and external regulations.

You will own the strategic roadmap, develop metrics, and deliver actionable reports to executives, while working with risk committees and internal stakeholders to mature security posture.

Qualifications

• Experience managing complex, client‑centric projects from conception to execution.
• Ability to identify proactive development and efficiency opportunities and articulate actionable plans.
• Enjoy working in matrix and cross‑functional teams and managing large‑scale initiatives.
• Strong communication skills and the ability to prioritize multiple tasks in a fast‑moving environment.

Responsibilities

• Discover and prioritize opportunities to mature the Amex third‑party cyber risk application.
• Drive the evolution of key performance metrics to measure third‑party cyber health across commercial portfolios and Amex events.
• Develop and maintain an adaptive reporting framework, generate metrics, and deliver actionable reports to senior management, risk committees, and internal stakeholders.
• Assess third‑party alignment with risk appetite, identify gaps, and recommend enforcement of mitigation controls that support risk mitigation objectives.
• Partner with internal stakeholders to develop, enhance, document, and enforce controls ensuring that software meets international regulatory requirements for third‑party data protection.
• Create training assets, processes, and communication plans to support enterprise adoption of these controls.
• Document requirements for enhancements to threat intelligence products, tools, automation scripts, and internally developed applications.
• Own the third‑party cyber risk strategic roadmap and portfolio.
• Serve as a domain expert and consultant for key internal business customers.

Skills

Project management

Strong communication

Cross-functional teamwork

Risk assessment

Threat modeling

Education

Bachelor’s Degree

Job description

American Express seeks an experienced Senior Information Security Manager to partner with leadership on a robust third‑party cyber risk program. The role will design, implement, and maintain controls across global operations, ensuring compliance with internal policies and external regulations.

You will own the strategic roadmap, develop metrics, and deliver actionable reports to executives, while working with risk committees and internal stakeholders to mature security posture.