Director-Privacy

The Global Risk & Compliance (GRC) organization serves as American Express’ independent risk management function. GRC maintains the enterprise risk framework, provides oversight and challenge, and monitors key risks. By embedding risk discipline into strategy and operations, GRC enables responsible growth, innovation, and long-term value creation while protecting customers and shareholders.

The American Express Global Privacy Oversight function provides trusted advice on the American Express Data Protection & Privacy Principles. We work to raise privacy awareness, drive compliance with both internal privacy policies and regulatory expectations across the organization and establish privacy as a strategic differentiator for the American Express brand. As a second line of defense function, Global Privacy Oversight oversees, provides expertise in, and challenges the identification, management, and mitigation of privacy risks across the company in line with the privacy framework and the company’s vision to provide the world’s best customer experience every day.

This position, based in Madrid, Spain, is part of the Global Risk and Compliance Organization - a second line of defense risk oversight function responsible for the independent management of privacy risk globally.  The role will report directly into the VP International Privacy, located in Madrid, Spain. The successful candidate will deploy a combination of extensive privacy expertise and a strong understanding of Artificial Intelligence to support the Global Privacy Office to deliver on business-critical strategic objectives.

• Lead a team of Privacy experts to accomplish privacy risk management goals, best practices and risk mitigation strategies.
• Support the business through Privacy Risk Assessments identifying and supporting mitigation of risks.
• Provide privacy guidance, credible challenge and ongoing second line oversight to pro-actively identify and address risks.
• Uplift the Global Privacy Oversight function´s governance and capabilities. 
• Champion a consistently strong control environment, and influence the continued enhancement of common controls.
• Build strong, collaborative relationships with First Line Business Unit partners, risk oversight functions, compliance, operational excellence, information security, legal and many others to drive privacy best practices throughout the enterprise.
• Key member of VP International´s Leadership team, able to engage and influence internally and externally.

Minimum Qualifications

• 10+ years’ experience in Risk Management/Compliance/Audit role or a highly regulated domain.
• Extensive experience in Privacy risk management, and familiarity with key regulations including GDPR, CCPA and emerging AI regulations.
• Demonstrated ability to manage risk strategically and tactically and deliver initiatives to advance the maturity and soundness of the control environment.
• Excellent written and verbal communication skills, able to create compelling arguments and influence across all levels of the organization.
• Excellent relationship building skills to partner effectively across diverse, cross-functional teams in complex and rapidly-changing environments. 
• Outstanding problem-solving and analytical skills, with strong learning agility and willingness to embrace and lead through change.
• Experience leading, engaging and motivating hardworking and diverse teams through complexities to deliver results.

Preferred Qualifications

• Relevant IAPP certifications.
• Familiarity with AI regulation, in place and emerging, globally.
• Experience working in a highly controlled environment and governing supporting policies and procedures.

Employment eligibility to work with American Express in Spain is required as the company will not pursue visa sponsorship for these positions.