Analyst - Reporting, Testing & Monitoring

The Global Risk & Compliance (GRC) organization serves as American Express’ independent risk management function. GRC maintains the enterprise risk framework, provides oversight and challenge, and monitors key risks. By embedding risk discipline into strategy and operations, GRC enables responsible growth, innovation, and long-term value creation while protecting customers and shareholders.
The Spain CRO function is part of the Int’l CRO team, within Global Risk and Compliance (GRC). It is responsible for identifying and overseeing risk across all processes.
How will you make an impact in this role?
The Analyst, Reporting, Testing & Monitoring, within the Spain CRO function, is responsible for supporting the establishment and enhancement of second-line assurance and testing capabilities.
Required Experience
Design and implementation of second-line testing programmes;
Assurance and control testing methodologies;
Integrated assurance frameworks.
Preferred Experience
Regulatory assurance activities;
Regulated financial services experience.
Minimum Qualifications
3-5 years of experience in risk management or a similar role;
Strong analytical skills and business acumen with a risk-reward control perspective; and the ability to balance commercial objectives with sound risk management.
Experience in interacting with regulators and familiarity with Spain and Europe’s regulatory landscape and requirements;
Demonstrated ability to successfully manage multiple priorities under pressure;
Fluency in English (verbal and written);
Degree in business, economics, engineering, or a related field; professional certifications such as FRM, CFA, are valued.
People Skills
Excellent relationship and influencing skills with the ability to build productive relationships across teams and levels of seniority;
Self-confident with a strong sense of integrity and the ability and willingness to challenge and be challenged;
Proactive in identifying issues, delivering and escalating key findings, and advising on recommended solutions to correct issues or mitigate risks;
Ability to communicate oversight findings to colleagues, business partners, and senior leaders;
Strong verbal and written communication skills.
Employment eligibility to work with American Express in Spain is required as the company will not pursue visa sponsorship for this position.
Key Responsibilities:
Maintain the Legal Entity Reporting and annual risk assessment for the market's legal entities;
Develop a multi-year testing plan based on the risk assessment, covering all Group risk pillars (Credit, Operational, etc.);
Prioritize testing activity using risk-based methodologies;
Align testing activity with enterprise risk assessments;
Support team in performing the planned second-line control reviews and preparing testing reports. You will communicate review outcomes to senior management and the relevant governance committees;
Define, together with the team, a remediation monitoring program for issues identified during control reviews and oversee the implementation of corrective actions;
Continuously enhance the tools, metrics, and reporting mechanisms used to inform senior management, ensuring that both emerging and existing risks are appropriately identified and managed;
Testing Framework Development by developing second-line testing methodologies, designing supporting policies, standards and procedures, establishing testing governance and quality standards and understanding current practice in testing processes in ILEs and driving ongoing improvement efforts toward implementing consistent best practice;
Integrated Assurance by coordinating assurance activities across first, second and third lines of defense, reducing duplication of testing activities, improving assurance coverage and effectiveness and developing integrated assurance frameworks and assurance maps;
Enterprise Testing Coordination by working with enterprise testing and assurance teams, aligning methodologies and reporting approaches and identifying opportunities for efficiency and consistency;
Reporting and Remediation by developing testing reporting frameworks, reporting findings to management and committees, tracking remediation activities and identifying thematic risks and control weaknesses.

Work arrangement
Hybrid