Director of Cyber Threat Intelligence

Job Description

Director, Cyber Threat Intelligence | American Express

The Tone:
This is a full-time role at American Express, with eligibility to work in the United States required. American Express enables and accelerates company growth strategies by delivering global capabilities and services to customers and colleagues, ensuring 24/7 availability and a high-quality experience. This role is crucial for leading the enterprise’s Cyber Threat Intelligence function, directly informing cybersecurity operations, risk management, and control design to maintain trust and security for the world’s best customer experience.

The TL;DR
• Role: Director
• Type: Full-time
• Location: In-person, Arizona

• Team: Part of the Information Security organization, collaborating closely with Cybersecurity Operations, Security Operations, and Incident Response teams.
• Mission: Lead the enterprise Cyber Threat Intelligence function to generate timely, actionable intelligence that informs cybersecurity operations, risk management, and control design.

What You’ll Actually Do
• Lead: Lead the enterprise Cyber Threat Intelligence function, generating timely, actionable intelligence that informs cybersecurity operations, risk management, and control design.
• Evolve: Lead the evolution of CTI into an agentic intelligence capability, operating a hybrid model of human analysts, AI-enabled intelligence pipelines, and supporting platform engineering capabilities.
• Ensure: Ensure intelligence drives measurable security outcomes through prioritization, detection alignment, control enhancement, and clear handoff to downstream execution teams.
• Provide: Provide tactical and operational intelligence to Security Operations and Incident Response, and strategic intelligence to leadership for risk prioritization and investment decisions.
• Direct: Direct the collection, analysis, and dissemination of actionable cyber threat intelligence aligned to business risk and operational priorities.

The Must-Haves
• Background: Director-level with a Bachelor’s degree in Intelligence, International Relations, Engineering, Computer Science, Business Management or Technology related fields, or at least 10 years of relevant experience, leading cyber threat intelligence or related cybersecurity disciplines.
• Experience: Extensive experience in cyber threat intelligence, intelligence analysis, or related cybersecurity disciplines, including proven experience leading intelligence programs or cybersecurity functions. Requires experience leading large-scale program transformation or operating model redesign.
• Skills: Deep understanding of adversary tactics, techniques, procedures (TTPs) and the threat ecosystem. Strong executive communication skills for briefing senior leadership. Ability to translate threat intelligence into operational or risk outcomes. Familiarity with AI/ML or LLM-based cybersecurity applications and human-in-the-loop AI governance.
• Bonus: Experience with intelligence-driven defense models and threat modeling frameworks. Experience working with intelligence community (IC), financial sector, or critical infrastructure environments. Experience integrating intelligence into detection engineering, incident response, or red team operations. Experience designing or operating automated or agent-driven intelligence workflows.