Analyst - Compliance

The Global Risk & Compliance (GRC) organization serves as American Express’ independent risk management function. GRC maintains the enterprise risk framework, provides oversight and challenge, and monitors key risks. By embedding risk discipline into strategy and operations, GRC enables responsible growth, innovation, and long-term value creation while protecting customers and shareholders.

This position is part of the Enterprise Technology Services (ETS) Second Line Compliance team and plays a key role in fostering a strong compliance culture, strengthening the control environment, and providing independent oversight of compliance risks across the Technology Services organization. The role supports a broad portfolio including Enterprise Platforms & Technology Business Management, Information Security, Global Infrastructure, and Enterprise Architecture across U.S. and International markets.

The successful candidate will partner with the Compliance Manager and Director to support the continued evolution and execution of an effective Compliance Risk Management Program, including Issue Management, Risk and Control Self-Assessments (RCSA), and Regulatory Change Management (RCM), and Compliance Risk Assessment (CRA) ensuring alignment with applicable laws, regulations, and regulatory expectations.

Qualifications

• Knowledge of compliance and operational risk management principles, governance frameworks, and regulatory expectations.
• Strong leadership, influencing, and collaboration skills, with experience working across organizations and partnering with relevent stakeholders.
• Ability to manage multiple priorities, and drive initiatives to completion in a fast-paced environment.
• Proven ability to exercise sound judgment, provide effective challenge, escalate issues appropriately, and navigate ambiguity.
• Strong analytical, written, and verbal communication skills, with the ability to synthesize complex information and tailor messaging for executive and non-technical audiences.
• Bachelor's degree or equivalent work experience.

Preferred Qualifications:

• Knowledge of technology processes, Information Security, Global Infrastructure, Enterprise Platforms & Technology Business Management, and Enterprise Architecture capabilities within Enterprise Technology Services.
• Experience within a Second Line Compliance, Operational Risk Management, Audit, or Regulatory function.
• Familiarity with Issue Management, Risk and Control Self-Assessments (RCSA), Regulatory Change Management (RCM), Compliance Risk Assessments (CRA) and related governance processes.
• Professional certification in compliance or risk (e.g. CAMS, CRCM, CRM, etc.).
• Employment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.

Responsibilities

• Provide regulatory compliance subject matter expertise and independent challenge to Enterprise Technology Services business partners and key stakeholders, escalating complex matters and emerging risks as appropriate.
• Develop and maintain knowledge of applicable laws, regulations, regulatory guidance, and industry standards relevant to technology, information security, data management, digital platforms, and emerging technologies.
• Support the execution and ongoing enhancement of the enterprise Compliance Risk Management Program within Enterprise Technology Services, including oversight of relevant policies, standards, risk assessments, and governance processes.
• Identify, assess, and monitor compliance risks, including evaluating control design and effectiveness and providing credible challenge regarding risk mitigation strategies and remediation plans.
• Review and challenge business processes, controls, risk assessments, and reporting to assess alignment with regulatory requirements, internal policies, and regulatory expectations.
• Identify, track, and oversee remediation of compliance-related issues, events, and regulatory findings, providing effective challenge to support sustainable resolution and prevent recurrence.
• Monitor emerging regulatory developments and assess potential impacts to technology-related activities, supporting implementation of required compliance changes.
• Prepare and deliver clear, concise risk assessments, reporting, and presentations for senior management, governance committees, and other stakeholders.