Information Security Manager - PCI

American Express Global Business Travel

3d • $104,300 - $193,700

About The Position

Amex GBT is seeking a PCI Compliance Manager to own its PCI DSS compliance program from planning through annual attestation. This hands-on role serves as the organization’s PCI subject matter expert, leading audit execution, defining the scope of the cardholder data environment, interpreting requirements, and partnering with engineering and IT teams to design practical, sustainable controls. The manager leads a team of two compliance professionals and works with security, technology, legal, and business partners across the organization.

Requirements

• 7+ years of experience in information security, governance, risk, or compliance, including 4+ years of hands-on PCI DSS experience.
• Experience leading PCI audits or assessments from beginning to end.
• Strong working knowledge of PCI DSS v4.x, including scoping, segmentation, and compensating controls.
• Solid technical foundation in networking, cloud environments, encryption, identity and access management, and logging and monitoring.
• Clear communication with both technical and non-technical audiences.
• Experience leading or mentoring others.

Nice To Haves

• PCI ISA, QSA, or PCIP certification.
• Additional certifications such as CISSP, CISA, CISM, or CRISC.
• Experience in payments, travel, or financial services.
• Familiarity with ISO 27001, SOC 2, or NIST frameworks.

Responsibilities

• Own the PCI DSS compliance program, including planning, audit execution, and annual attestation.
• Lead assessments and coordinate with external assessors.
• Define and maintain the scope of the cardholder data environment, including data flows and segmentation.
• Interpret PCI requirements and translate them into clear, workable controls.
• Plan and carry out control validation and testing across all PCI requirements.
• Perform risk reviews and manage the exception and compensating control process.
• Assess PCI responsibilities of vendors and payment partners.
• Advise business, product, and legal teams on decisions that impact PCI compliance.
• Report program status and risks to security leadership.
• Coach, mentor, and develop team members.

Benefits

• Discretionary annual bonus based on company and individual performance.
• Health and welfare insurance plans.
• Retirement programs.
• Parental leave.
• Adoption assistance.
• Wellbeing resources for employees and their immediate family.
• Travel deals on flights, hotels, cruises, and car rentals.
• Access to over 20,000 courses on the learning platform and leadership courses.
• Access to new job openings available to internal candidates first.
• Global Inclusion Groups.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed