Manager, IT Cybersecurity Governance, Risk & Compliance

Location: [[location]]

Cities: [[sfstd_jobLocation_obj]]

Requisition ID: [[id]]

Intro

Are you ready to explore a world of possibilities, both at work and during your time off? Join our American Airlines family, and you’ll travel the world, grow your expertise and become the best version of you. As you embark on a new journey, you’ll tackle challenges with flexibility and grace, learning new skills and advancing your career while having the time of your life. Feel free to enrich both your personal and work life and hop on board!

Why you'll love this job

• As one diverse, high-performing team dedicated to technical excellence, you will focus relentlessly on delivering unrivaled digital products that drive a more reliable and profitable airline.
• As a Cybersecurity GRC Manager, you will lead a specialized team shaping how American measures, prioritizes, and manages cyber risk across technology, applications, and third parties. You’ll bring together risk methodology, data and analytics, and GRC platform engineering to turn complex risk information into actionable insights and better-informed business decisions. You’ll advance risk metrics and enterprise data integration while evolving GRC platforms, workflows, automation, and reporting to scale risk management as threats, technology, and business priorities change.

What you'll do

As noted above, this list is intended to reflect the current job but there may be additional essential functions (and certainly non-essential job functions) that are not referenced. Management will modify the job or require other tasks be performed whenever it is deemed appropriate to do so, observing, of course, any legal obligations including any collective bargaining obligations.

• Support Cybersecurity GRC Capabilities: Lead or support governance, risk, compliance, and control-related activities within assigned areas, helping ensure expectations are clear, practical, and aligned to enterprise risk and regulatory requirements.
• Lead and Develop Teams: Lead, coach, and develop team members supporting assigned cybersecurity GRC functions; set clear expectations, strengthen accountability, and foster consistent execution across priorities.
• Oversee Assigned GRC Processes and Capabilities: Provide management oversight for assigned tools, processes, reporting, and capabilities that support areas such as policy management, risk assessment, third party risk management, control assurance, compliance tracking, remediation governance, or leadership visibility.
• Support Policy, Standards, and Control Governance: Support the development, maintenance, communication, and adoption of cybersecurity policies, standards, and control expectations within assigned areas to promote clear ownership and consistent security practices.
• Manage Risk and Control Activities: Lead or support risk and control activities within assigned responsibilities, including identifying gaps, assessing impact, supporting risk decisions, and tracking remediation progress.
• Support Compliance and Regulatory Activities: Lead or support activities related to cybersecurity compliance obligations, audits, assessments, evidence collection, issue management, and readiness for applicable regulatory and industry requirements.
• Partner Across Stakeholder Groups: Partner with Cybersecurity, Technology, Legal, Audit, Privacy, Compliance, and business teams to align expectations, resolve issues, support risk-informed decisions, and drive accountability for assigned actions.
• Deliver Clear Risk and Compliance Reporting: Prepare and communicate clear, outcome-focused reporting within assigned areas, including risk, compliance, control performance, audit findings, remediation progress, and key decisions for leadership and stakeholders.
• Improve GRC Practices and Execution: Identify opportunities to improve assigned processes, controls, documentation, metrics, and operating practices to strengthen transparency, consistency, accountability, and cybersecurity program maturity.

All you'll need for success

Minimum Qualifications – Education & Prior Job Experience

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Business, Risk Management, Compliance, Audit, or a related discipline, or equivalent experience/training.
• Experience delivering and leading cybersecurity, information technology, risk management, compliance, audit, governance, or related activities.

Preferred Qualifications – Education & Prior Job Experience

• Bachelor's degree in Information Security, Computer Science, or a related field; advanced degree preferred
• 6+ years of experience in cybersecurity, information technology, risk management, compliance, audit, governance, or a closely related field preferred, and 3+ years of leadership experience
• Experience leading cybersecurity governance, risk management, compliance, control management, or related enterprise programs, including setting priorities, defining outcomes, and improving program maturity.
• Experience overseeing security audits, assessments, control assurance activities, remediation governance, and executive reporting to ensure clear ownership, accountability, and timely risk reduction.
• Experience applying regulatory, risk, compliance, and control frameworks such as NIST, ISO 27001, PCI DSS, SOX, SOC 2, CMMC, GDPR, or similar standards to guide strategy, prioritization, governance, and leadership decision-making.

All you'll need for success (continued....)

Skills, Licenses, and Certifications

• Experience evolving cybersecurity risk methodologies and analytical approaches to incorporate threat, exposure, control effectiveness, and business context into risk assessment and prioritization.
• Strong knowledge of cybersecurity risk management, including risk identification and analysis, inherent and residual risk, risk scoring and prioritization, risk treatment and acceptance, risk appetite and tolerance, and risk and control frameworks.
• Strong understanding of risk and control management, including risk and control libraries, control effectiveness, issues and exceptions, risk acceptance, and remediation governance.
• Experience with third-party risk management practices, including supplier risk assessments, due diligence, control reviews, issue remediation, ongoing monitoring, and alignment of third-party cyber risk requirements to enterprise risk and compliance expectations.
• Strong understanding of risk metrics, analytics, and data, with experience translating cybersecurity, control, and risk data into meaningful indicators, trends, and decision-support for leadership.
• Experience integrating or leveraging data across GRC platforms, enterprise data environments/data lakes, security platforms, and reporting or visualization tools to improve risk measurement and insights.
• Experience with GRC platform engineering and enablement, including data models, integrations, workflows, automation, reporting, and platform evolution. Experience with platforms such as Archer, ServiceNow GRC/IRM, OneTrust, or similar technologies is preferred.
• Working knowledge of established cybersecurity and risk frameworks, such as NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF), ISO 27001/27005, and other relevant industry frameworks.
• Strong leadership, communication, and stakeholder-management skills, with experience leading specialized teams and influencing decisions across Cybersecurity, Technology, enterprise risk, and business functions.
• Relevant professional certification such as CISSP, CRISC, CISM, or equivalent is preferred.
• Demonstrated ability to translate complex technical risks and data into clear business risk insights and recommendations for senior leaders and nontechnical stakeholders.
• Demonstrated ability to lead cross-functional teams and influence senior stakeholders across cybersecurity, technology, finance, legal, audit, privacy, compliance, and business teams, with strong judgement and executive presence to navigate ambiguity, drive alignment, and escalate material risk decisions appropriately.
• Ability to set strategic direction, define capability roadmaps, prioritize work, and align cyber products and services to enterprise risk, regulatory, and business objectives.
• Experience building, coaching, and developing high-performing teams, including setting expectations, strengthening accountability, and improving delivery across multiple workstreams.

What you'll get

Feel free to take advantage of all that American Airlines has to offer:

• Travel Perks: Ready to explore the world? You, your family and your friends can reach 365 destinations on more than 6,800 daily flights across our global network.
• Health Benefits: On day one, you’ll have access to your health, dental, prescription and vision benefits to help you stay well. And that’s just the start, we also offer virtual doctor visits, flexible spending accounts and more.
• Wellness Programs: We want you to be the best version of yourself – that’s why our wellness programs provide you with all the right tools, resources and support you need.
• 401(k) Program: Available upon hire and, depending on the workgroup, employer contributions to your 401(k) program are available after one year.
• Additional Benefits: Other great benefits include our Member Assistance Program, pet insurance and discounts on hotels, cars, cruises and more

Feel free to be yourself at American

From the team members we hire to the customers we serve, inclusion and diversity are the foundation of the dynamic workforce at American Airlines. Our 20+ Team Member Resource Groups are focused on connecting our team members to our customers, suppliers, communities and shareholders, helping team members reach their full potential and creating an inclusive work environment to meet and exceed the needs of our diverse world.

Are you ready to feel a tremendous sense of pride and satisfaction as you do your part to keep the largest airline in the world running smoothly as we care for people on life’s journey? Feel free to be yourself at American.

Cities: [[sfstd_jobLocation_obj]]

Requisition ID: [[id]]