Manager - CyberOps & Assurance-Incident Response

At American Express, our mission is to deliver the world’s best customer experience every day. At the heart of this mission is our Information Security organization, enabling exceptional experiences built on a foundation of trust, service, and security. We leverage advanced technologies and data-driven insights to stay ahead of an evolving threat landscape. We foster a culture of passion, curiosity, and courage—empowering you to innovate, grow, and help shape the future of a Fortune 100 company.

Trust. Service. Security.

American Express seeks to recruit a passionate and experienced Leader for its Incident Response team. This is a senior-level, hands-on, highly technical role performing incident response activities ranging from pre-incident preparation, active incident response, and post-incident analysis and recovery. You will be a key technical resource conducting investigations, performing advanced analysis, identifying attacker TTPs, building attack narratives, and executing response actions.

As part of our evolution toward a Next Generation Agentic SOC, this role will also help drive the adoption of AI-enabled security operations, intelligent automation, and autonomous analyst workflows. The ideal candidate combines deep incident response expertise with curiosity and practical experience in AI-assisted detection, security automation, and modern SOC engineering practices.

You are a motivated leader who will directly manage, mentor, and develop a team of SOC analysts while driving the people, processes, and technology that empower the team to investigate sophisticated threats at scale. This role requires critical thinking, innovative problem solving, technical leadership, people leadership, and effective communication across both technical and executive audiences.

• 3+ years of experience in information security, security operations, incident response, threat hunting, or cyber defense.
• Experience with host, network, and/or memory forensics.
• Experience with various network and/or host-based security tools used to detect and respond to security events (e.g., SIEM, EDR, NDR, SOAR, web proxy, IDS/IPS, cloud-native security platforms, etc.).
• Theoretical and practical security knowledge and investigation experience with Mac, Linux, Windows, and cloud environments.
• Strong understanding of incident response lifecycles, attacker methodologies, and cyber kill chain concepts.
• Experience performing analysis of complex security incidents in enterprise environments.
• Familiarity with scripting or programming languages such as Python, PowerShell, Go, or similar.
• Ability to convey complex technical concepts to audiences with varying levels of technical expertise.
• Strong analytical, investigative, documentation, and communication skills.
• Demonstrated curiosity and adaptability toward emerging AI-enabled security technologies and workflows.
• Demonstrated ability to lead, motivate, and develop technical teams in high-tempo, operationally demanding environments.
• Strong interpersonal and conflict-resolution skills, with the ability to foster a collaborative, inclusive, and psychologically safe team environment.

Preferred:

• 1+ years of experience in a people leadership, team lead, or supervisory role, including direct responsibility for coaching, mentoring, or managing technical staff.
• Experience working within a modern SOC leveraging AI-assisted analysis, security automation, and/or SOAR technologies.
• Familiarity with AI/ML concepts and practical applications within cybersecurity operations.
• Experience with prompt engineering, LLM-assisted workflows, or AI copilots for security investigations and operational efficiency.
• Understanding of AI agent architecture, orchestration frameworks, retrieval-augmented generation (RAG), vector databases, or autonomous workflow concepts.
• Experience integrating APIs, automation pipelines, or AI-enabled tooling into SOC workflows.
• Knowledge of adversarial AI threats, prompt injection risks, model misuse, or AI security governance principles.
• Experience building or operationalizing automated detection, enrichment, triage, or response capabilities.
• Knowledge and investigation experience in a global, multi-cloud environment.
• Experience with detection engineering, threat hunting, or behavioral analytics.
• Familiarity with cloud-native security technologies and telemetry sources.
• Multiple applicable certifications (GSE, GDAT, GCIA, GCIH, GCFA, GNFA, GCFE, GREM, CCSP, CISSP, CEH, etc.).
• AI-related certifications or hands-on experience with enterprise AI platforms, orchestration frameworks, or automation tooling.
• Experience managing performance cycles, conducting calibrations, and building talent development plans within a security operations or SOC environment. Experience managing geographically distributed or shift-based teams supporting 24×7 operations.

Employment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.