Associate - Tech Risk & Control

Global Infrastructure (GI) provides the foundational platforms and services that enable reliable, secure technology delivery across the enterprise, working across multiple teams and domains to keep the environment resilient and well controlled. Cross Platform Delivery (CPD) is Global Infrastructure's thin, cross-GI orchestration layer connecting work that spans platforms and teams to enable consistency, transparency, and enterprise credibility without duplicating line ownership. Role Overview As an Associate Technology Risk Manager in CPD, you will orchestrate delivery of cross GI risk artifacts, such as MAPs, OREs, and PSRs, when inputs span multiple teams or responsibility is unclear. The role supports the Director by coordinating ownership, actions, and escalation paths with ETS Governance & Control partners so GI delivers a single, consistent narrative and on-time updates without taking on risk/control ownership or remediation execution. How you will make an impact Drive a consistent GI technology risk posture by synthesizing inputs across teams into one clear view of risk, progress, and priorities. Clarify ownership, decision points, and escalation paths for cross-GI risk initiatives where accountability is potentially distributed or unclear. Improving the quality, completeness, and consistency of GI risk artifacts and updates leverage within GI and across the enterprise. Produce oversight-ready risk narratives that connect issues, events, controls, and remediation into an accurate, enterprise-aligned story. Enable timely decisions by highlighting trends, concentrations, and cross-cutting dependencies, and by escalating when delivery is at risk. Bachelor's degree in Computer Science, Information Systems, Engineering, Cybersecurity, or equivalent practical experience. Experience in technology risk, operational risk, controls, or technology governance within a large, complex enterprise technology environment . Working knowledge of the first line/ second line/ third line (FLOD/SLOD/TLOD) model, including how to partner effectively across Technology, Control Management, Risk, Compliance, and Internal Audit while maintaining appropriate role clarity. Ability to synthesize complex inputs (issues, events, assessments, control gaps, remediation plans) into clear written narratives and executive-ready summaries. Experience coordinating deliverables across multiple stakeholders, including tracking actions, managing dependencies, and operating with urgency in time-bound situations. Familiarity with common technology risk and control domains (e.g., change/release management, resilience, access management, vulnerability management, incident/problem management, monitoring/observability, and third-party/affiliate considerations). Practical experience using risk and workflow platforms and reporting tools (e.g., Archer, ServiceNow GRC, or similar, data visualization and reporting capabilities), with a focus on outcomes and clarity over tool administration.

Preferred skills Cross-platform thinking:

Comfortable operating across infrastructure, platforms, and enabling capabilities, identifying patterns and connecting related risks across multiple products and teams.

Ambiguity management:

Able to define the problem, propose a plan, and drive progress when information is incomplete or ownership is distributed.

Executive communication:

Strong writing and presentation skills; able to tailor messages by audience and turn complex detail into clear decisions and actions.

Influence without authority:

Proven ability to build alignment, negotiate tradeoffs, and move work forward through strong relationships and credibility.

Continuous improvement mindset:

Interest in simplifying processes, strengthening reporting, and improving evidence quality through better ways of working. Employment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.