Manager - Audit

American Express•New York, NY

About The Position

American Express’s Internal Audit Group (IAG) is a worldwide function with more than 300 team members and offices across nine countries. Its mission is to protect and enhance organizational value through independent, objective, risk-based assurance and advisory services, and to influence how the company manages risk. IAG’s professionals bring expertise across areas including internal controls, consumer compliance, technology, operational risk, financial accounting, data analytics, and banking operations. Audit teams align to key risk areas and business units, while the Professional Practices group manages audit operations, quality and standards, regulatory relations, reporting, training and professional development, and internal capabilities and technologies. The Privacy Audit Manager, based in New York, NY, leads and executes risk-based audits focused on data privacy, data protection, and compliance with applicable regulatory requirements. The role aligns with IAG’s Privacy Subject Matter Expert group and provides specialized expertise in assessing privacy risks, evaluating internal controls, and delivering actionable insights to strengthen privacy governance and risk management.

Requirements

At least 5 years of audit experience.
Prior experience in privacy and an understanding of emerging regulations and their impact on control practices.
Prior experience working at a Big Four firm or a G-SIB.
Strong written and verbal communication skills, including the ability to deliver high-quality work and actionable feedback to management on issues, opportunities, and deficiency solutions.
Ability to lead a team in a fast-paced environment, drive business results, manage projects, think creatively, and work across competing priorities.
Critical-thinking skills to break down complex problems and reach risk-based conclusions using data analysis, process knowledge, risk and control knowledge, and experience.
Ability to apply control theory and professional auditing practices throughout the audit lifecycle.
Understanding of regulations, regulatory risks, accounting, and financial-industry best practices relevant to the business, including emerging technology and data considerations, and ability to incorporate them into the audit approach.
Eligibility to work in the United States; American Express will not pursue visa sponsorship for these positions.

Nice To Haves

Experience conducting risk-based internal audits focused on data privacy, data protection, and information governance within a large, complex financial services organization.
Strong knowledge of global privacy laws and regulatory requirements, including GDPR, CCPA/CPRA, and other applicable U.S. and international privacy regulations.
Experience assessing privacy governance frameworks, data lifecycle management, consent management, data retention, and third-party data-sharing controls.
Familiarity with privacy risk management frameworks and standards, including the NIST Privacy Framework and ISO 27701.
Experience evaluating privacy risks associated with emerging technologies, including artificial intelligence, cloud computing, and data analytics.
Proficiency in assessing the design and operating effectiveness of privacy controls, identifying control gaps, and developing actionable recommendations.
Experience collaborating with Privacy, Legal, Compliance, Information Security, and Technology teams to evaluate regulatory compliance and enterprise-wide privacy risks.
Relevant certifications such as CIPP/US, CIPP/E, CIPM, CIA, or CISA.
Experience with data analytics tools, data visualization, key risk indicators, key performance indicators, information systems and technology, and scorecards or dashboards.
Interest in working with data, interpreting results, analytic best practices, and experience with data analytics and visualization tools.

Responsibilities

Serve as Auditor in Charge on audits, managing engagements end-to-end, planning projects, defining objectives and scope, and coordinating with control groups, external auditors, stakeholders, and regulators.
Conduct L1 reviews and serve as the primary audit client contact.
Analyze audit results and documentation, evaluate effectiveness and efficiency, and synthesize audit findings.
Lead audit client meetings and walkthroughs.
Develop test steps, audit findings, and audit reports in accordance with IAG policies and procedures.
Guide teams in validating and executing corrective actions that are impactful, sustainable, and improve business-unit control environments.
Support business monitoring activities with audit leadership, track key metrics to identify control issues and trends, and assess the business impact of industry developments, external news, and regulatory changes.
Delegate tasks, guide auditors in assessing risks and control design and executing audit tests, and review and provide feedback on work papers.
Coach, teach, mentor, and develop less experienced colleagues and co-sourced resources across audit work, the audit and analytic lifecycle, methodology, and best practices.
Conduct post-audit feedback discussions with team members to provide actionable feedback, support development, and recognize accomplishments.
Guide teams to communicate task status, roadblocks, and challenges proactively and routinely, and suggest potential solutions.