Senior Third-Party Cyber Risk Manager (Hybrid)

American Express; Columbia (SC); Hybrid; USD 110,000 - 190,000; Full time

Benefits offered by this job

Hybrid work options

6% retirement match

Unlimited professional development

Flexible work arrangements

Parental leave

Health and wellbeing resources

Job summary

American Express is seeking a Senior Information Security Manager to lead third-party cyber risk strategy and governance. The role focuses on building robust risk programs, reporting, and collaboration with internal stakeholders across the enterprise.

You will drive risk metrics, mature risk management practices, and provide governance across multiple portfolios and thousands of third‑party entities, with a strong emphasis on regulatory alignment and analytics.

Qualifications

• Proven experience managing critical cyber risk initiatives from planning through execution.
• Strong ability to identify proactive opportunities for improvement and articulate actionable plans.
• Experience driving complex, large-scale change in matrixed organizations.
• Excellent organization, prioritization, and multitasking skills.
• High attention to detail and strong analytical mindset; ability to diagnose issues and drive consensus solutions.
• Excellent written and verbal communication skills.

Responsibilities

• Partner with the Director of Third-Party Security Strategy & Governance to lead strategic third‑party cyber risk projects.
• Build and maintain a robust third‑party cyber risk working version.
• Drive program compliance through continuous reporting on cyber risk metrics and provide consulting to internal stakeholders.
• Identify and champion opportunities to mature Amex’s third‑party risk management practices.
• Evolve key threat metrics to measure third‑party cyber readiness across business portfolios and thousands of third‑party entities.
• Develop and oversee a reporting framework, generating monthly metrics and delivering actionable reports to senior leadership, risk committees, and cross‑functional teams.
• Assess third‑party alignment with program objectives and recommend standardized methodologies to achieve risk appetite alignment.
• Collaborate with cross‑functional partners to improve processes and ensure compliance with global regulatory requirements for third‑party data security risk.
• Create educational materials, workflows, and communication plans to support program execution organization‑wide.
• Define requirements for, and support the development of, tools, automation scripts, and internal solutions to improve risk management effectiveness.
• Own the third‑party cyber risk strategic roadmap and portfolio management.
• Provide domain expertise and advice to business customers across the organization.

Skills

Cyber risk management

Policy governance

Stakeholder communication

Project leadership

Analytics & reporting

Regulatory compliance

Job description

American Express is seeking a Senior Information Security Manager to lead third-party cyber risk strategy and governance. The role focuses on building robust risk programs, reporting, and collaboration with internal stakeholders across the enterprise.

You will drive risk metrics, mature risk management practices, and provide governance across multiple portfolios and thousands of third‑party entities, with a strong emphasis on regulatory alignment and analytics.