Director, Cyber Defense

Amex GBT offers an inclusive, collaborative culture where colleagues can inspire travel as a force for good. The Director, Cyber Defense will lead the Cyber Security Incident Response (CSIRT), Cyber Threat Intelligence (CTI), Detection Engineering, and Data Security Investigations (DSI) teams, setting strategy, building programs, and partnering with Legal, Privacy, HR, and executive leadership to protect traveler, colleague, and data trust.

Responsibilities

• Lead and grow four connected teams (CSIRT, CTI, Detection Engineering, DSI) as a unified cyber defense function with shared priorities and operating rhythm.
• Define vision, roadmap, and budget for cyber defense capabilities; report progress and risk to senior leadership.
• Hire, coach, and develop team leads and analysts; build a bench capable of operating under high‑pressure incidents.
• Establish and track metrics such as dwell time, mean time to detect and respond, investigation closure rates, and intelligence coverage.
• Own the end‑to‑end incident response program: playbooks, severity classification, escalation paths, after‑action reviews; act as incident commander for major incidents.
• Run tabletop exercises and simulations to test company‑wide readiness.
• Maintain relationships with outside counsel, forensics firms, and law‑enforcement contacts for complex incidents.
• Direct collection, analysis, and distribution of threat intelligence; translate intelligence into detection content and hunting priorities.
• Represent Amex GBT in intelligence‑sharing communities and industry groups; build vendor and peer relationships.
• Set priorities for detection content across SIEM, EDR, cloud, and identity systems using frameworks such as MITRE ATT&CK; drive continuous tuning to reduce false positives.
• Champion automation and orchestration to focus team effort on judgment‑based tasks.
• Lead investigations of inappropriate access, use, or disclosure of sensitive data, including privacy cases involving colleagues, contractors, or third parties.
• Develop a defensible investigative process with evidence handling, chain of custody, documentation, and clear findings.
• Collaborate with Legal, Privacy, and HR on cases with disciplinary, regulatory, or legal exposure; advise on data loss prevention, access controls, and insider‑risk indicators.

Qualifications

• 10+ years of cybersecurity experience, including 5+ years leading incident response, security operations, or a similar function.
• Direct experience overseeing sensitive investigations involving data privacy, insider risk, or employee conduct, preferably in partnership with Legal or HR.
• Working knowledge of threat intelligence practices and how intelligence should shape detection priorities.
• Experience with detection engineering concepts: SIEM/EDR content development, use‑case design, and frameworks such as MITRE ATT&CK.
• Proven track record leading live incidents and communicating clearly to non‑technical executives under pressure.
• Familiarity with global privacy and data‑protection regulations (e.g., GDPR, CCPA).
• Experience managing managers and building high‑performing teams.
• Bachelor’s degree in a related field or equivalent experience.

Preferred Qualifications

• Experience in travel, hospitality, financial services, or other sectors handling large volumes of personal and payment data.
• Relevant certifications such as CISSP, GCIH, GCFA, GCTI, or equivalent.
• Experience with 24/7 or global “follow‑the‑sun” security operations models.
• Background working with outside counsel, forensics vendors, or law‑enforcement on significant incidents.

Benefits

• Flexible benefits tailored to each country, starting day one (health & welfare insurance, retirement programs, parental leave, adoption assistance, wellbeing resources).
• Travel perks: weekly deals on flights, hotels, cruises, and car rentals.
• Access to over 20,000 courses on the learning platform, leadership courses, and internal job opportunities.
• Inclusion groups for various identities and initiatives to foster a diverse workplace.
• Additional perks and programs as detailed in the Benefits‑at‑a‑Glance document.

Pay

The U.S. national base salary range for this position is $130,200 – $241,800. Compensation is based on role complexity, experience, skills, knowledge, and work location. The role is also eligible for a discretionary annual bonus tied to company and individual performance.