Manager-CyberOps & Assurance

At American Express, our culture is built on a 175-year history of innovation, shared values and Leadership Behaviors, and an unwavering commitment to back our customers, communities, and colleagues. As part of Team Amex, you'll experience this powerful backing with comprehensive support for your holistic well-being and many opportunities to learn new skills, develop as a leader, and grow your career.

Here, your voice and ideas matter, your work makes an impact, and together, you will help us define the future of American Express.

How will you make an impact in this role?

POSITION SUMMARY

The Cyber Threat Intelligence (CTI) team protects the American Express brand, global business operations, technology infrastructure and client trust against cyber threats worldwide. The CTI team collects, analyzes, and disseminates knowledge about adversaries and their motivations, intentions, and methods to help American Express at all levels protect the critical assets of the enterprise and customers.

The CTI Manager-Cybersecurity Operations & Assurance produces actionable intelligence in a clear and concise manner and defines top threats impacting American Express in support of Lines of Business. The position entails both strategic and operational responsibilities for technology and intelligence processes. Critical skills include fostering relationships with key stakeholders by providing awareness, indications, warnings, and operational readiness.  

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Create written and verbal intelligence products for internal AXP customers to assist in proactively addressing threats.  

• Develop and present key findings to senior leadership.

• Perform open-source threat collection and analysis activities identifying indication of cyber threats, identify malicious code, websites, and vulnerabilities using existing and purpose-built tools. 

• Develop collection priorities that align with customer interests.

• Identify credible new intelligence and subject matter resources relative to current/emerging threats.

• Provide subject matter expertise on cyber threats to support current analytic operations and initiatives.

Minimum Qualifications

• Knowledge of common security controls, detection capabilities, and securing digital environments, including packet flows/TCP & UDP traffic, firewall and proxy technologies, anti-virus, intrusion detection/prevention systems, host-based monitoring, email monitoring, spam technologies, and SIEMs.

• Experience in analyzing malware/hacking tools and threat actor tactics, techniques, and procedures to characterize threat actors’ methods for accomplishing their missions.

• Basic understanding of forensic analysis on and data captures from networks/packet capture, hosts (volatile/live memory), electronic media, log data, and network devices in support of intrusion analysis or enterprise level information security operations.

• Basic understanding of what information or assets are of value to threat actors and how organizations are breached.

• Understanding of modern technical security controls (i.e., firewalls, SIEMs, IPS, HIPS, web proxies).

• Must have strong verbal and written communication skills, analytic writing, interpersonal collaborative skills, and the ability to communicate security and risk-related concepts to both technical and non-technical audiences.

• Knowledge or experience in application of structured analytic techniques to generate and test hypotheses, assess cause an