Associate, Technology Risk & Control at American Express

• Associate, Technology Risk & Control facilitates the identification, assessment, and mitigation of technology risks by conducting thorough risk evaluations, developing risk management strategies, and ensuring compliance with industry standards and regulatory requirements. Ensures that technology teams are meeting the requirements set forth in the Technology Resilience policies and standards. Assists in reporting to various stakeholders throughout the company.

How will you make an impact in this role?

Key Responsibilities:

• Conducts assessments to identify potential risk within the organization's technology environments, ensuring that technology resilience areas are evaluated for weaknesses
• Ensures Technology teams are adhering to the organization's Resilience related policies and standards. Communicates and reports on successes and gaps
• Prepares reports and documentation to support risk management activities and compliance efforts, for internal stakeholders and leaders
• Conducts risk assessments to determine the residual risk within the organization's technology environments, ensuring all areas are evaluated for non-compliance
• Supports the identification and evaluation of controls and adherence to controls
• Collaborates and co-creates effectively with teams in product and the business to align technology initiatives with business objectives

Minimum Qualifications:

• Bachelor's Degree in Computer Science, Information Systems, Cybersecurity, and/or comparable experience
• Knowledge of regulatory compliance and security standards (e.g., ISO, NIST, FFIEC Handbooks, GDPR)
• Foundational knowledge of global technology standards and applicable regulations
• Foundational knowledge of technology control domains such as Disaster Recovery, Business Continuity Management, Security Governance & Operations, IT General Controls, Security Testing, and Cloud Security
• Skilled in enterprise risk management with an emphasis on operational risk management and technology risk
• Experience working in teams to successfully complete projects in Computer Science, Information Systems, and/or Cybersecurity
• Experience working with teams in Technology Resilience / Disaster Recovery
• DORA (Digital Operational Resilience Act)
• ORMCM

Key requirements

• Operational Resilience
• Disaster Recovery
• Understanding of regulatory environment

Technology Risk Experience

• Controls
• Regulations 
• Disaster Recovery 

Under regulations, must have:

• Disaster Recovery experience
• Incident Problem & Change Management