Sr Manager, IT Cybersecurity Data Protection

The Sr. Manager, IT Cybersecurity Data Protection will lead American Airlines’ enterprise Data Protection and Privacy Technology program, owning strategy, roadmap, engineering, and continuous improvement. The role develops modern privacy and data protection controls, integrates privacy-by-design into platforms and AI solutions, and leads global teams.

Role Overview

This position drives the direction and execution of data protection and privacy technology capabilities, translating requirements into actionable guidance for senior leadership, technology teams, and business partners. The Sr. Manager will also evaluate effectiveness using KPIs and telemetry, oversee risk assessments and compliance checks, and coordinate response efforts during data protection and privacy incidents.

Key Responsibilities

• Own and lead the enterprise Data Protection and Privacy Technology strategy and roadmap, ensuring modern controls are built, deployed, and continuously improved, including classification, encryption, access governance, DLP, masking, and AI/ML safeguards.
• Develop deep understanding of enterprise data flows, promoting secure data handling practices and shared accountability while aligning data protection and privacy decisions with business priorities and technology strategy.
• Balance data protection and privacy objectives with business requirements, guiding decisions that reflect organizational risk appetite and operational realities with limited direction from business or portfolio leadership.
• Provide oversight and direction for data protection and privacy technology capabilities, programs, services, and engagement model, governing adherence to policies and standards and owning the global operating model.
• Translate complex data protection and privacy requirements into clear, actionable guidance for senior leaders, technology teams, and business partners.
• Shape how data protection and privacy controls are integrated into new technology development to mitigate risks early and effectively.
• Bridge engineering, cybersecurity, privacy, and business teams to embed data protection and privacy by design into platforms, applications, and AI solutions.
• Evaluate the effectiveness of data protection and privacy technologies using KPIs, telemetry, and operational metrics to drive maturity, automation, and risk reduction.
• Conduct and oversee data protection and privacy by design risk assessments, product evaluations, compliance checks, and audits to support regulatory requirements.
• Oversee coordination with appropriate teams during data protection and privacy incidents, ensuring accurate reporting, communication, and follow-through.
• Drive data protection and privacy awareness programs to improve end user understanding of data protection responsibilities and emerging threats.
• Serve as a primary point of contact between business or portfolio executive leadership and product teams, engaging executive leadership and communicating program progress and service delivery.
• Build and lead global teams of data protection engineers, privacy engineers, and analysts, fostering technical excellence, continuous learning, and innovation.
• Oversee a team of up to 50 team members across multiple squads.

Required Qualifications

• Bachelor’s degree in Computer Science, Information Systems, Engineering, Cybersecurity, or a related technical field.
• 8+ years of progressive experience in cybersecurity, data protection, privacy engineering, or information security.
• 3+ years of experience leading technical teams in a large enterprise environment.
• Prior experience driving large-scale security or privacy technology initiatives from strategy through execution.
• Ability to collaborate across cybersecurity, legal, data, product, and engineering teams to embed privacy and security into systems and workflows.
• Advanced communication ability to explain data protection and privacy concepts to non-technical audiences and convert complex requirements into practical guidance.
• Knowledge of data protection industry practices and global privacy regulations (GDPR, CCPA/CPRA, PCI, etc.) and the ability to translate them into technical controls aligned with NIST CSF/PRMF and ISO/IEC 27001/27701.
• Strong understanding of data security and privacy engineering, secure data lifecycle practices, and access control models.
• Familiarity with cybersecurity or privacy-related risk assessment methodologies and frameworks.
• Professional certifications such as CISSP, CIPP/E, CIPP/US, CIPT, CDPSE, CCSP, or equivalent privacy/security credentials.
• Ability to deliver prioritized outcomes using agile and product management principles.
• Experience implementing and managing data protection and privacy technologies including DLP, data discovery/classification, encryption/tokenization, access governance, cloud data security, data and code scanning tools, DSAR/rights automation platforms, and consent and preference management tools.
• Experience using KPIs, operational telemetry, and maturity metrics to measure the effectiveness of privacy-by-design controls.
• Leadership, communication, and relationship-building skills to influence stakeholders at all levels.
• Excellent analytical and problem-solving skills with strong attention to detail.
• Solution-oriented mindset, capable of defining pragmatic alternatives that drive appropriate cybersecurity outcomes.
• Ability to work independently with initiative.
• Master’s degree in computer science, Cybersecurity, Engineering, Information Assurance, or a related technical field.
• 12+ years of experience in cybersecurity, privacy engineering, data protection, or information security.
• 5+ years of leadership or management experience overseeing technical teams and driving enterprise-level initiatives.
• Experience leading data protection or privacy engineering programs and teams in highly regulated industries such as aviation, financial services, or healthcare.

Technologies

• DLP
• AI/ML
• GDPR
• CCPA/CPRA
• PCI
• NIST CSF
• NIST PRMF
• ISO/IEC 27001
• ISO/IEC 27701
• encryption
• tokenization
• masking
• access governance
• data discovery/classification
• cloud data security
• data and code scanning tools
• DSAR/rights automation platforms
• consent and preference management tools

Location and Employment Type

• Location: Fort Worth, TX (onsite)
• Employment Type: Full-time

Benefits

• Travel perks, including reach to 365 destinations on more than 6,800 daily flights across the global network.
• Health benefits including health, dental, prescription, and vision; virtual doctor visits; and flexible spending accounts.
• Wellness programs.
• 401(k) program available upon hire, with employer contributions potentially available after one year depending on workgroup.
• Additional benefits including an Employee Assistance Program, pet insurance, and discounts on hotels, cars, cruises, and more.