Director - Tech Risk & Control

Role Summary
Joining Amex Tech means discovering and shaping your contribution to something big. Here, you can work alongside talented tech teams and build a unique career with the Powerful Backing of American Express. With a range of opportunities to work with the latest technologies, and a commitment to back the broader engineering community through open source, our mission is to power your success. Because Amex Tech is powered by our technology, our culture, and our colleagues.
The Technology organization enables and accelerates the company’s growth strategies, delivering global capabilities and services in support of Amex’s customers and colleagues, while maintaining 24/7 servicing and availability to ensure an uninterrupted, high-quality customer experience. Technology provides the foundation for everything we do in the company while driving differentiation through building and leveraging innovative technology and data insights.
The Director, Control Risk Advisory - GCST & USCDT, is a strategic advisory leader dedicated to supporting two Senior Leadership Team (SLT) members and their Technology organizations: Global Commercial Services Technology (GCST) and U.S. Consumer Services and Digital Technology (USCDT). The role provides an independent, forward-looking view of technology, information security, operational, and control risk; delivers clear and decision-oriented risk reporting; identifies emerging trends and leading indicators; and helps the two organizations prioritize pragmatic risk-reduction actions in alignment with business strategy, delivery commitments, and risk appetite. For GCST, the Director connects risk advisory to the GCS vision of backing businesses so they can do more business and to its mission of being the undisputed leader in financial and membership services for businesses while responsibly driving double-digit revenue growth, with particular attention to modernizing foundational capabilities and improving governance and controls. For USCDT, the Director supports the technology capabilities that power U.S. consumer products, Membership experiences, digital acquisition, banking, payments, marketing, travel, dining, Ads & Offers, and other mobile- and web-enabled experiences. The Director leads and develops a high-performing advisory team and champions responsible use of AI and GenAI to improve advisory effectiveness, operational efficiency, and decision quality.
Portfolio Focus
GCST: Serve as the dedicated Control Risk Advisory partner to GCST leadership, connecting technology risk reporting, risk reduction, and prioritization to GCS business priorities, growth objectives, client needs, foundational modernization, and stronger governance and controls.
USCDT: Serve as the dedicated Control Risk Advisory partner to USCDT leadership across the technology portfolio that enables U.S. consumer products and experiences, including digital acquisition, banking, payments, marketing, travel, dining, Ads & Offers, and mobile- and web-enabled capabilities that strengthen the value of Membership.
Across both Technology organizations: Establish a consistent, comparative view of risk posture; surface cross-portfolio themes and dependencies; support transparent trade-off decisions; and focus leadership attention and resources on the highest-priority, highest-impact risk-reduction opportunities.
6+ years of experience in operational risk management, technology risk, information security risk, control management, Internal Audit, or a related risk discipline, with demonstrated understanding of critical risk-management lifecycle activities.
Experience leading technology risk and control teams and setting strategic direction while operating autonomously and driving measurable outcomes.
Demonstrated credibility with senior technology and security leaders, including experience supporting broad product, platform, or business-aligned technology portfolios as a trusted advisor who can challenge constructively and escalate appropriately.
Proven ability to translate complex technical and risk issues into executive-level business insights, portfolio reporting, prioritization decisions, and measurable risk-reduction outcomes.
Strong track record of using risk data, metrics, and analytical techniques to identify trends, detect leading indicators, evaluate scenarios, and influence decisions.
Experience leading complex mitigation, remediation, transformation, or control-improvement initiatives through influence, execution discipline, and cross-functional accountability.
Experience embedding risk and control considerations into product development, technology change, service delivery, or operational processes.
Experience establishing governance routines, decision forums, escalation paths, and executive risk-reporting mechanisms that enable transparent, comparative, and timely portfolio decision-making.
Experience facilitating risk awareness, education, or capability building for business, technology, or product leaders and teams.
Experience applying or enabling AI/GenAI, automation, or advanced analytics to improve risk advisory, monitoring, analysis, or operational efficiency, with appropriate governance and human oversight.
Experience working across geographically distributed and diverse teams and stakeholders in a complex matrixed environment.
Financial-services experience preferred.
B40 Leadership & Leveling Expectations
Independently handles complex work assignments that affect multiple teams, products, services, or risk domains and exercises sound judgment with limited direction.
Executes strategies with significant organizational impact and converts strategic objectives into measurable team and risk outcomes.
Makes independent decisions across products, services, risk priorities, and stakeholder needs, balancing technical depth, business context, regulatory expectations, and risk appetite.
Leads larger teams or departments, develops talent, establishes accountability, and makes key decisions that shape the advisory function and broader risk posture.
Demonstrates leadership agility in ambiguity, adapts to rapidly evolving technology and regulatory landscapes, and maintains strategic focus while accelerating delivery.
Core Capability Profile
High Technical Acumen: Deep technology, information security, cyber-risk, and modern engineering knowledge; translates technical complexity into business risk.
Autonomous Leadership & Strategic Execution: Sets vision, leads with minimal direction, and drives accountable, measurable outcomes.
Advanced Analytical Capability: Uses risk data, trends, metrics, and leading indicators to surface emerging issues and enable predictive risk management.
Executive Presence, Communication & Storytelling: Influences senior stakeholders through concise, clear, decision-oriented risk narratives.
Deep Risk Expertise: Applies strong technology, information security, governance, control, regulatory, and operational-resilience judgment.
Leadership Agility: Leads through ambiguity and changing priorities while sustaining learning, focus, and delivery.
AI & GenAI Adoption Mindset: Uses AI and GenAI responsibly to improve advisory effectiveness and decision quality while ensuring governance, security, and controls.
Pragmatic Risk Reduction & Delivery: Turns risk insight into practical mitigation, accountability, accelerated execution, and sustainable proactive risk reduction.
Employment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.
Lead, mentor, and coach a high-performing Risk Advisory team aligned to the GCST and USCDT portfolios, setting a clear strategic vision, creating an inclusive culture of continuous learning, and using feedback and metrics to strengthen individual and team performance.
Establish credibility and trusted-advisor relationships with the GCST and USCDT SLT leaders and their senior Technology teams, balancing effective risk management with GCS and U.S. Consumer business priorities, delivery commitments, growth objectives, and strategic outcomes; provide clear, candid, evidence-based challenge while maintaining strong partnerships and influencing decisions without direct authority.
Provide strategic risk advice across GCST and USCDT product, platform, and service areas, helping leaders make informed decisions by translating complex architectures, engineering practices, control environments, and technical issues into concise business-risk implications tied to customer, colleague, growth, and operational outcomes.
Assess and report risk posture using data, metrics, leading i

Work arrangement
Hybrid