Manager, IT Cybersecurity Governance, Risk & Compliance

American Airlines is building a more reliable, profitable airline through digital excellence. In this onsite role in Fort Worth, TX, you will lead a specialized cybersecurity governance, risk, and compliance (GRC) team, helping translate complex cyber risk into risk-informed decisions across technology, applications, and third parties. You will combine risk methodology, data and analytics, and GRC platform engineering to improve how cyber risk is measured, prioritized, and managed.

What you’ll do

• Lead or support governance, risk, and compliance activities within assigned areas, ensuring expectations are practical and aligned to enterprise risk and regulatory requirements.
• Lead, coach, and develop team members supporting cybersecurity GRC functions by setting clear expectations, strengthening accountability, and driving consistent execution.
• Provide management oversight for tools, processes, reporting, and capabilities supporting areas such as policy management, risk assessment, third-party risk management, control assurance, compliance tracking, remediation governance, and leadership visibility.
• Support the development, maintenance, communication, and adoption of cybersecurity policies, standards, and control expectations to promote clear ownership and consistent security practices.
• Lead or support risk and control work including identifying gaps, assessing impact, supporting risk decisions, and tracking remediation progress.
• Drive readiness activities related to cybersecurity compliance obligations, including audits, assessments, evidence collection, issue management, and fulfillment of applicable regulatory and industry requirements.
• Partner with Cybersecurity, Technology, Legal, Audit, Privacy, Compliance, and business teams to align expectations, resolve issues, and support risk-informed decisions.
• Prepare and communicate outcome-focused reporting covering risk, compliance, control performance, audit findings, remediation progress, and key decisions for leadership and stakeholders.
• Identify improvements to processes, controls, documentation, metrics, and operating practices to strengthen transparency, consistency, accountability, and program maturity.

What you bring

• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Business, Risk Management, Compliance, Audit, or a related discipline, or equivalent experience/training.
• Experience delivering and leading cybersecurity, information technology, risk management, compliance, audit, governance, or related activities.
• Experience evolving cybersecurity risk methodologies and analytical approaches using threat, exposure, control effectiveness, and business context.
• Strong knowledge of cybersecurity risk management, including inherent and residual risk, risk scoring and prioritization, risk treatment and acceptance, risk appetite and tolerance, and risk and control frameworks.
• Strong understanding of risk and control management, including risk/control libraries, control effectiveness, issues and exceptions, risk acceptance, and remediation governance.
• Experience with third-party risk management such as supplier risk assessments, due diligence, control reviews, issue remediation, ongoing monitoring, and aligning third-party cyber risk requirements to enterprise expectations.
• Strong understanding of risk metrics, analytics, and data, including translating cyber/control/risk data into decision-support indicators and trends.
• Experience integrating or leveraging data across GRC platforms, enterprise data environments or data lakes, security platforms, and reporting or visualization tools.
• Experience with GRC platform engineering and enablement, including data models, integrations, workflows, automation, and reporting. Experience with Archer, ServiceNow GRC/IRM, OneTrust, or similar technologies is preferred.
• Working knowledge of established frameworks such as NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF), ISO 27001/27005, and other relevant industry frameworks.
• Leadership, communication, and stakeholder-management experience leading specialized teams and influencing decisions across Cybersecurity, Technology, enterprise risk, and business functions.
• Ability to translate complex technical risks and data into clear business risk insights and recommendations for senior leaders and nontechnical stakeholders.
• Ability to set strategic direction, define capability roadmaps, prioritize work, and align cyber products and services to enterprise risk, regulatory, and business objectives.
• Experience building, coaching, and developing high-performing teams with strong accountability and delivery across multiple workstreams.

Tools and frameworks you may use

Archer, ServiceNow GRC/IRM, OneTrust, NIST CSF, NIST RMF, ISO 27001, ISO 27005, PCI DSS, SOX, SOC 2, CMMC, GDPR.

Benefits

• Travel perks: reach 365 destinations on more than 6,800 daily flights across the global network.
• Health benefits: access to health, dental, prescription and vision benefits; virtual doctor visits; flexible spending accounts.
• Wellness programs.
• 401(k) program (available upon hire; depending on workgroup, employer contributions after one year).
• Additional benefits: Member Assistance Program, pet insurance, discounts on hotels, cars, cruises and more.

Inclusion at American

Inclusion and diversity are the foundation of the dynamic workforce at American Airlines. The organization also has 20+ Team Member Resource Groups focused on connecting team members to customers, suppliers, communities, and shareholders.