Director, Cyber Threat Intelligence

Joining Amex Tech means discovering and shaping your contribution to something big. Here, you can work alongside talented tech teams and build a unique career with the Powerful Backing of American Express. With a range of opportunities to work with the latest technologies, and a commitment to back the broader engineering community through open source, our mission is to power your success. Because Amex Tech is powered by our technology, our culture, and our colleagues.

The Technology organization enables and accelerates the company’s growth strategies, delivering global capabilities and services in support of Amex’s customers and colleagues, while maintaining 24/7 servicing and availability to ensure an uninterrupted, high-quality customer experience. Technology provides the foundation for everything we do in the company while driving differentiation through building and leveraging innovative technology and data insights.

At American Express, our mission is to deliver the world’s best customer experience every day. At the heart of this mission is our Information Security organization, enabling exceptional experiences built on a foundation of trust, service, and security. We leverage advanced technologies and data-driven insights to stay ahead of an evolving threat landscape. We foster a culture of passion, curiosity, and courage—empowering you to innovate, grow, and help shape the future of a Fortune 100 company.

Trust. Service. Security.

American Express is seeking a Director of Cyber Threat Intelligence to lead the enterprise CTI function responsible for generating timely, actionable intelligence that directly informs cybersecurity operations, risk management, and control design. The Cyber Threat Intelligence team operates an end-to-end intelligence lifecycle that transforms internal and external threat data into decision-relevant intelligence to support proactive risk identification, incident response, and strategic prioritization.

As part of the evolving Cybersecurity Operations model, this role is focused on intelligence generation, enterprise threat modeling, and intelligence-driven control design input. This role is explicitly focused on intelligence production, prioritization, threat modeling, and control enhancement recommendations, and does not own execution of cyber threat remediation or defense enablement activities. The function is accountable for ensuring intelligence drives measurable security outcomes through prioritization, detection alignment, control enhancement, and clear handoff to downstream execution teams. This role will also lead the evolution of CTI into an agentic intelligence capability, operating a hybrid model of human analysts, AI-enabled intelligence pipelines, and supporting platform engineering capabilities. AI-driven collection, enrichment, and analysis pipelines will scale intelligence production, improve speed and coverage, and enhance consistency, while human analysts remain accountable as decision authorities and quality gates over intelligence outputs.

The CTI team provides tactical and operational intelligence to Security Operations and Incident Response, strategic intelligence to leadership to inform risk prioritization and investment decisions, and continuous intelligence support during active events and emerging threats. The team operates with defined processes, governance, and quality standards to ensure intelligence is timely, accurate, and actionable, while collaborating closely with cybersecurity operations teams to continuously refine outputs. Lead the collection, analysis, and dissemination of actionable cyber threat intelligence aligned to business risk and operational priorities 

• Deliver executive-level intelligence briefings and reporting on adversary activity, emerging threats, and enterprise exposure
• Own and operate the enterprise CTI-driven threat modeling capability as a primary function, maintaining a current adversary model and embedding intelligence directly into architecture, engineering, and security control design
• Ensure intelligence outputs translate into specific, actionable control enhancement recommendations, with clear handoff and traceability to downstream execution teams
• Ensure adversary behavior and intelligence insights directly inform control design and security architecture where applicable
• Drive integration of threat intelligence into detection engineering, threat hunting, incident response, and vulnerability prioritization workflows
• Establish and enforce intelligence product standards, quality controls, and reporting cadence t