Director of Incident Response Tooling - job 9 of 11

We are seeking an experienced Director of Incident Response Tooling to lead our team of engineers in designing, implementing, and maintaining a robust incident response tooling infrastructure to support our monitoring and detection capabilities. The ideal candidate will have a strong background in incident response engineering, with a focus on monitoring and detection tools such as SIEM and UEBA, as well as experience working with major Cloud Service Providers (CSPs) and SIEM tools.

Key Responsibilities:

• Lead a team of engineers in designing, implementing, and maintaining a comprehensive incident response tooling infrastructure, including SIEM, UEBA, and other monitoring and detection tools.
• Develop and maintain a deep understanding of the MITRE framework and its application to incident response and threat detection.
• Collaborate with cross-functional teams to integrate logging and monitoring capabilities from primary services (e.g. storage, compute, networking) from major CSPs (AWS, Azure, GCP) into our incident response tooling infrastructure.
• Design and implement data integration mechanisms between log source providers and SIEM tools using Syslog, REST API, and Message brokers (Kafka).
• Collaborate with the data management team to develop and maintain a data lakehouse architecture for long-term storage of incident response data.
• Ensure compliance with internal audit requirements and external regulatory assessments (e.g. SOC2, PCI DSS).
• Collaborate with vendor partners to support multi-million dollar deals and ensure successful implementation of incident response tooling solutions fully leveraging out of the box capabilities from their tool kit
• Develop and maintain relationships with internal stakeholders such as Global Infrastructure, Digital Workspace and other teams within Cyber Security
• Provide technical guidance and oversight to ensure the incident response tooling infrastructure is aligned with business objectives and security requirements.
• Stay up-to-date with emerging trends and technologies in incident response and threat detection, and apply this knowledge to inform tooling and process improvements.

Qualifications:

• 5+ years of experience in people management, with a proven track record of leading high-performing teams.
• Bachelor's degree in Computer Science, Cyber Security, or related field.
• Strong financial management skills, with experience managing budgets over $3 million USD.
• Experience working with major Cloud Service Providers (CSPs) such as AWS, Azure, and GCP.
• Expertise in major SIEM tools such as Elasticsearch, Splunk, and Datadog.
• Strong understanding of the MITRE framework and its application to incident response and threat detection.
• Experience handling audit requests from internal audit agencies and external regulators.
• Strong communication and leadership skills, with the ability to collaborate with cross-functional teams.
• At least one security certification (e.g. CISSP, CCSP, CISM).
• Strong analytical and problem-solving skills, with the ability to think critically and strategically.

Salary Range: $170,000.00 to $255,000.00 annually + bonus + equity (if applicable) + benefits

The above represents the expected salary range for this job requisition. Ultimately, in determining your pay, we’ll consider your location, experience, and other job-related factors.

We back you with benefits that support your holistic well-being so you can be and deliver your best. This means caring for you and your loved ones' physical, financial, and mental health, as well as providing the flexibility you need to thrive personally and professionally:

• Competitive base salaries 
• Bonus incentives 
• 6% Company Match on retirement savings plan 
• Free financial coaching and financial well-being support 
• Comprehensive medical, dental, vision, life insurance, and disability benefits 
• Flexible working model with hybrid, onsite or virtual arrangements depending on role and business need 
• 20+ weeks paid parental leave for all parents, regardless of gender, offered for pregnancy, adoption or surrogacy 
• Free access to global on-site wellness centers staffed with nurses and doctors (depending on location) 
• Free and confidential counseling support through our Healthy Minds program 
• Career development and training opportunities

For a full list of Team Amex benefits, visit our Colleague Benefits Site.

American Express is an equal opportunity employer and makes employment decisions without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran status, disability status, age, or any other status protected by law. American Express will consider for employment all qualified applicants, including those with arrest or conviction records, in accordance with the requirements of applicable state and local laws, including, but not limited to, the California Fair Chance Act, the Los Angeles County Fair Chance Ordinance for Employers, and the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance. For positions covered by federal and/or state banking regulations, American Express will comply with such regulations as it relates to the consideration of applicants with criminal convictions.

We back our colleagues with the support they need to thrive, professionally and personally. That's why we have Amex Flex, our enterprise working model that provides greater flexibility to colleagues while ensuring we preserve the important aspects of our unique in-person culture. Depending on role and business needs, colleagues will either work onsite, in a hybrid model (combination of in-office and virtual days) or fully virtually.

US Job Seekers - Click to view the “Know Your Rights” poster. If the link does not work, you may access the poster by copying and pasting the following URL in a new browser window: https://www.eeoc.gov/poster

Employment eligibility to work with American Express in the United States is required as the company will not pursue visa sponsorship for these positions.