Information Security Manager

You Lead the Way. We ve Got Your Back.

At American Express, you ll be recognized for your contributions, leadership, and impact every colleague has the opportunity to share in the company s success. Together, we ll win as a team, striving to uphold our company values and powerful backing promise to provide the world s best customer experience every day. And we ll do it with the utmost integrity, and in an environment where everyone is seen, heard and feels like they belong.

Join Team Amex and let's lead the way together.

How will you make an impact in this role?

The Information Security Manager role resides within the Regional Information Security Office and is responsible for cyber security control enforcement, awareness, reporting and enablement for American Express standard controls at 3 rd party environment supporting American Express Banking Corp. The incumbent will be responsible for helping design and execute a regionalized information security risk management strategy closely informed by the Technology risk teams and regulatory requirements.

Key responsibilities include:

• Assist with the interconnection between core enterprise information security functions and American Express Asia-pacific legal entities


• Contribute to the first line information security risk management and reporting


• Assess the design and operating effectiveness of information security controls upon which the American Express Asia-pacific legal entities rely to protect Confidentiality, Availability, and Integrity of Information and Systems


• Collaborate with General Counsel, Market Compliance, and the American Express Privacy Office to support market regulatory requirements


• Identify, scope, and investigate new information security risks, including assisting with assessment of key American Express third-party providers in the region


• Deliver leadership reporting and risk metrics that demonstrate the effectiveness of the cyber security program to American Express Asia-pacific legal entities.


• Consult on market-specific Business & Technologies projects to ensure appropriate security protection


• Craft responses to Information Security audit and examination requirements for the market


• Operate as part of the extended Information Security team in support of all security and compliance initiatives


• Collaborate with global teams, 3 rd parties to publish market specific Information Security KPIs/KRIs


• Support assessment of Information security risks in new products and changes in products on 3rdparty platforms.


• Participate in represent regional information security office in India Banks risk committees

Required Skills:

• 5-10 years of Information Security and/or Data Privacy


• Experience working with regulators, such as RBI, MeiTI, in complex regulated businesses


• Broad understanding of information security disciplines with emphasis on vulnerability management, data protection, infrastructure security, application security, identity and access, incident management and data analytics


• Strong in risk management. Ability to link threats to risk tolerance and control effectiveness measurements.


• Understanding of cyber regulatory landscape

Required Work Experience, Education, Certification / Training:

• Bachelor s degree in computer science, information systems, network security or other related field. Master s degree preferred


• Professional certifications (CISSP, CRISC, CISA, PCI, CISM or equivalent)


• At least 5 years work experience in information security or technology risk management


• Technical background with hands-on experience across a variety of technologies


• Proficiency in information security, risk management and audit (risk/security policies, procedures and controls)

Required Knowledge, Skills and Abilities:

• Exceptional verbal and written communication skills


• Ability to lead and drive discussions on technical matter with senior business stakeholders along with partners and regulators


• Fluency in English language


• Requires knowledge of a minimum of several business and technical functional capabilities in some of the following areas: security architecture; security engineering; threat management; vulnerability management; electronic discovery; computer and data breach incident management; data protection; forensics; 3rd party/vendor management; security monitoring; cryptography; cloud security; security operations and administration; access management; security policies and standards; security awareness; business continuity; disaster recovery; IT risk management and controls; web security; data security; network security; system security, technology operations and compliance


• Strong knowledge and experience in risk assessment and relevant methodologies including quantitative risk management techniques


• Knowledge of applicable information security standards and regulatory requirements


• Highly self-motivated and directed


• Keen attention to detail

Benefits include:

• Competitive base salaries
• Bonus incentives
• Support for financial-well-being and retirement
• Comprehensive medical, dental, vision, life insurance, and disability benefits (depending on location)
• Flexible working model with hybrid, onsite or virtual arrangements depending on role and business need
• Generous paid parental leave policies (depending on your location)
• Free access to global on-site wellness centers staffed with nurses and doctors (depending on location)
• Free and confidential counseling support through our Healthy Minds program
• Career development and training opportunities