Job Description

The Enterprise Technology Services organization partners with every part of the American Express business to power the company’s growth and innovation with trust and efficiency, and drive competitive differentiation with speed. We support the delivery and operations of technology, digital, and data capabilities, platforms, and services globally. Specifically, our team is responsible for the company’s technology engineering, architecture, and infrastructure, providing 24x7 support to ensure an uninterrupted, high-quality experience for customers and colleagues. We also provide product management for core enterprise platforms, and lead technology risk and information security, enterprise data governance and platforms, digital product and design, and enterprise AI platforms on behalf of the company.

American Express is seeking an Incident Response Analyst to join our Cybersecurity Operations organization and help protect the company, our colleagues, and our customers from evolving cyber threats. It is an exciting opportunity to join a world class defensive team protecting a complex network during a watershed moment of AI driven threats.

This is an investigative role with expanded incident response and project work responsibilities. It combines alert triage duties with advanced investigation and response to confirmed malicious activity.

The successful candidate will be AI literate and prepared to work in and help develop an increasingly AI-enabled SOC.

• Monitor, assess, prioritize, and investigate security alerts and incidents using enterprise security telemetry and threat intelligence.
• Escalate when specialist expertise is required.
• Investigate confirmed malicious activity across endpoint, identity, network, cloud, and other relevant data sources.
• Execute or coordinate approved containment actions.
• Maintain clear documentation of incident timelines, investigative notes, evidence, decisions, and response actions.
• Collaborate with peer incident responders, threat intelligence, detection engineering, wider technology and business teams.
• Participate in post-incident reviews and lessons learned, identifying opportunities to improve detections, playbooks, telemetry, and response processes.
• Use AI-enabled security capabilities to accelerate triage, investigation, response, and documentation.
• Identify incident response activities suitable for automation or AI-enabled workflows.
• Support development of AI-enabled security capabilities.
• Knowledge of cybersecurity, security operations, and incident response.
• Understanding of threat actor tactics, techniques and procedures.
• Familiarity with an enterprise level range of technologies and security tools like SIEM, EDR/XDR/NDR, identity, cloud, and security orchestration technologies.
• Strong analytical skills and the ability to develop evidence-based investigative conclusions using logs and telemetry from multiple sources.
• AI literacy, including an understanding of the capabilities and limitations of generative AI and AI agents.
• Curiosity and strong willingness to develop new skills.

Experience in a SOC, incident response or cybersecurity environment, or AI-enabled security tooling is preferred.

Cybersecurity certifications relevant to the role include Security+, CySA+, GCIH, GCIA, GSOC.

Employment eligibility to work with American Express in the UK is required as the company will not pursue visa sponsorship for these positions.