Manager, Digital, Data and Technology Compliance

The Global Risk & Compliance (GRC) organization serves as American Express' independent risk management function. GRC maintains the enterprise risk framework, provides oversight and challenge, and monitors key risks. By embedding risk discipline into strategy and operations, GRC enables responsible growth, innovation, and long-term value creation while protecting customers and shareholders.

This position is part of the Enterprise Technology Services (ETS) Second Line Compliance team and plays a key role in fostering a strong compliance culture, strengthening the control environment, and providing independent oversight of compliance risks across the Technology Services organization. The role supports a broad portfolio including Information Security, Enterprise Architecture, Platforms, Data & AI, Enterprise Digital, and Digital Acquisition Platforms across U.S. and international markets.

The successful candidate will partner with the Compliance Director to support the continued evolution and execution of an effective Compliance Risk Management Program, including Compliance Risk Assessments (CRA), Issue Management, Risk and Control Self-Assessments (RCSA), and Regulatory Change Management (RCM), ensuring alignment with applicable laws, regulations, and regulatory expectations.

At American Express, our culture is built on a 175-year history of innovation, shared values and Leadership Behaviors, and an unwavering commitment to back our customers, communities, and colleagues. From delivering differentiated products to providing world-class customer service, we operate with a strong risk mindset, ensuring we continue to uphold our brand promise of trust, security, and service.

As part of Team Amex, you'll experience our powerful backing with comprehensive support for your holistic well-being and many opportunities to learn new skills, develop as a leader, and grow your career. Here, your voice and ideas matter, your work makes an impact, and together, you will help us define the future of American Express.

Qualifications:

• Knowledge of compliance and operational risk management principles, governance frameworks, and regulatory expectations.
• Strong leadership, influencing, and collaboration skills, with experience working across matrixed organizations and partnering with senior stakeholders.
• Ability to manage multiple priorities, execute independently, and drive initiatives to completion in a fast-paced environment.
• Proven ability to exercise sound judgment, provide effective challenge, escalate issues appropriately, and navigate ambiguity.
• Strong analytical, written, and verbal communication skills, with the ability to synthesize complex information and tailor messaging for executive and non-technical audiences.
• Bachelor''s degree or equivalent work experience.

Preferred Qualifications:

• Knowledge of technology processes, information security, data management, digital platforms, or technical capabilities within Enterprise Technology Services.
• Experience within a Second Line Compliance, Operational Risk Management, Audit, or Regulatory function.
• Familiarity with Compliance Risk Assessments (CRA), Risk and Control Self-Assessments (RCSA), Issue Management, Regulatory Change Management (RCM), and related governance processes.
• Professional certification in compliance or risk (e.g. CAMS, CRCM, CRM, etc.).

Employment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.

• Provide regulatory compliance subject matter expertise and independent challenge to Enterprise Technology Services business partners and key stakeholders, escalating complex matters and emerging risks as appropriate.
• Develop and maintain knowledge of applicable laws, regulations, regulatory guidance, and industry standards relevant to technology, information security, data management, digital platforms, and emerging technologies.
• Support the execution and ongoing enhancement of the enterprise Compliance Risk Management Program within Enterprise Technology Services, including oversight of relevant policies, standards, risk assessments, and governance processes.
• Identify, assess, and monitor compliance risks, including evaluating control design and effectiveness and providing credible challenge regarding risk mitigation strategies and remediation plans.
• Review and challenge business processes, controls, risk assessments, and reporting to assess alignment with regulatory requirements, internal policies, and regulatory expectations.
• Identify, track, and oversee remediation of compliance-related issues, events, and regulatory findings, providing effective challenge to support sustainable resolution and prevent recurrence.
• Monitor emerging regulatory developments and assess potential impacts to technology-related activities, supporting implementation of required compliance changes.
• Prepare and deliver clear, concise risk assessments, reporting, and presentations for senior management, governance committees, and other stakeholders.
• Provide regulatory compliance subject matter expertise and independent challenge to Enterprise Technology Services business partners and key stakeholders, escalating complex matters and emerging risks as appropriate.
• Develop and maintain knowledge of applicable laws, regulations, regulatory guidance, and industry standards relevant to technology, information security, data management, digital platforms, and emerging technologies.
• Support the execution and ongoing enhancement of the enterprise Compliance Risk Management Program within Enterprise Technology Services, including oversight of relevant policies, standards, risk assessments, and governance processes.
• Identify, assess, and monitor compliance risks, including evaluating control design and effectiveness and providing credible challenge regarding risk mitigation strategies and remediation plans.
• Review and challenge business processes, controls, risk assessments, and reporting to assess alignment with regulatory requirements, internal policies, and regulatory expectations.
• Identify, track, and oversee remediation of compliance-related issues, events, and regulatory findings, providing effective challenge to support sustainable resolution and prevent recurrence.
• Monitor emerging regulatory developments and assess potential impacts to technology-related activities, supporting implementation of required compliance changes.
• Prepare and deliver clear, concise risk assessments, reporting, and presentations for senior management, governance committees, and other stakeholders.