Senior Associate-Technology Risk & Control

The Enterprise Technology Services (ETS) organization partners with the American Express business to enable, support, and drive the company’s growth plans and strategic priorities by supporting the delivery and operations of technology capabilities, platforms, and services globally. Specifically, the team delivers global capabilities and services in support of American Express customers and colleagues, and it is responsible for the company’s technology infrastructure, providing 24x7 support to ensure an uninterrupted, high-quality experience for external and internal customers. It also governs technology risk and information security across the American Express enterprise.

The objective of the ETS Control Management Issues, Events & Remediation team is to ensure timely identification, response, and resolution of risk events and issues to minimize impact, as well as to prevent recurrence through effective remediation and lesson learning.

ETS Control Management is looking for a Senior Associate Tech Risk & Control of Issues, Events & Remediation to focus on ensuring control management is embedded in the day-to-day operations of our organization. It will involve extensive collaboration with multiple partners across numerous business units, functional areas, and geographies.

The Senior Associate Tech Risk & Control, ETS Control Management Issues, Events & Remediation will:

• Scope, triage (prioritize), and support remediation of Issues by influencing BU, who own and execute Issue/Operational Risk Event (ORE) Remediation
• Investigate and conduct root cause analysis while also addressing repeated Issue types
• Conducts advanced risk assessments to identify complex risks within the organization's technology environments, ensuring that all critical areas are evaluated for security weaknesses
• Monitors technology environments to detect, analyze, and respond to emerging threats in real-time, utilizing advanced threat detection tools and techniques to minimize any potential security incidents
• Ensure risk management practices align with the organization's overall risk appetite and compliance standards, maintaining a balanced approach to risk-taking
• Perform quality assurance on documentation of Issue/ORE type, urgency, severity/impact (e.g., impact analysis), and investigate as necessary to understand and address the root causes
• Oversee the remediation process, including tracking progress, validate resolution efficacy, and communicate status updates to stakeholders to embed accountability along the process, collaborating with other Operational Risk Management (ORM) / Control Management teams as necessary
• Document and maintain records of Issues/OREs and Remediations to ensure transparency and accountability in the issue management process
•  Analyze trends in Issues and events to identify potential systemic risks or control weaknesses within BU processes
•  Support and oversee the End-to-End (E2E) Issue resolution process, embedding accountability and ensuring lessons learned are integrated into future ORM practices
•  Perform sample testing of Issues to ensure resolution is complete and effective
•   Assesses potential impact of emerging technologies and industry trends, emerging threats, and best practices in Technology Risk & Control, ensuring that the organization remains proactive and prepared to address new and evolving risks
• Supports the identification and evaluation of controls and adherence to controls, providing preliminary analysis and recommendations
• Engage with key stakeholders, including business unit leaders, compliance officers, and regulatory bodies, to facilitate effective issue management and resolution
• Prepare and present detailed reports on Issue status, trends, and outcomes to senior management and governance committees
•  Be a key leader for sharing insights, better practices, themes, etc. across the enterprise
•  Build cordial working relationship across stakeholders including ETS, Compliance, second line risk pillar teams, ORM, ECM and peer CM teams, among others.
•  Be well versed to use AI tools to improve the productivity and accuracy of the Risk and control management activities
• Uses AI-enabled analytics and workflow tools to accelerate risk trending, evidence review, and first-pass identification of control gaps or non-compliance.
• Supports the evaluation of AI-related technology risk, including data quality, human oversight, and documentation of AI-assisted processes.
• Supports identification of risks associated with AI-enabled processes, automation, and technology changes.

Required Qualifications: 

•  5+ Years experience in operational risk management and understanding of critical operational risk management lifecycle activities
•  Excellent project management, communication, and interpersonal skills, with an ability to interact and obtain buy-in from senior BU/tech counterparts
• Expertise in process governance, with a track record of establishing and overseeing robust decision-making processes that align with policies, regulatory frameworks, and/or operational standards
•  Experience within financial services industry
•  Strong analytical and problem-solving skills, with an ability to analyze data, identify trends, and evaluate risk scenarios effectively
• Demonstrated history and ability to manage large teams, spread over geographies and with varying backgrounds
• Have executive presence and be able to provide status updates to senior leadership.
• Understanding and knowledge of AI systems,concepts relevant to technology risk and control work.
• Working knowledge of responsible AI, including governance, validation, and monitoring of Agentic AI workflows.
• Familiarity with AI risk management concepts such as explainability, transparency, biases, hallucinations, and control testing.
• Basic familiarity with AI risk governance concepts aligned to emerging industry practices such as the NIST AI RMF, ISO/IEC 42001 and model risk management principals
• Experience applying AI features in GRC or reporting tools to improve analysis and documentation quality.
• Experience working with cross-functional teams on technology risk, control, or compliance activities involving AI processes.

Preferred Qualifications:

• Bachelor’s degree in information technology, Information Security. Risk Mgmt., or related field; advanced degrees (e.g., MBA, MSc) or certifications are advantageous
• Experience in at least one of the following: 
  • Scoping, assess incoming requests, prioritizing, and support remediation of operational issues
  • Investigating and conducting root cause analysis to address repeated operational risk issue types
  • Performing quality assurance on documentation of operational risk issues and events
  • Overseeing the remediation process for operational risk issues and events
  • Documenting and maintaining records of operational risk issues and events to ensure transparency and accountability
  • Supporting and overseeing the E2E issue resolution process, embedding accountability, and ensuring lessons learned are integrated into future operational risk management practices