American Airlines is looking for a Cybersecurity GRC Manager to lead governance, risk, and compliance activities spanning technology, applications, and third parties. This onsite role in Fort Worth supports clear control expectations, strengthens risk decision-making with measurable metrics, and evolves cybersecurity GRC workflows, automation, and reporting.
What you’ll do
- Lead or support governance, risk, and compliance and control-related activities within assigned areas, helping ensure expectations are practical, clear, and aligned to enterprise risk and regulatory requirements.
- Lead, coach, and develop team members supporting cybersecurity GRC functions by setting clear expectations, strengthening accountability, and driving consistent execution across priorities.
- Provide management oversight for tools, processes, reporting, and capabilities supporting areas such as policy management, risk assessment, third party risk management, control assurance, compliance tracking, remediation governance, and leadership visibility.
- Support development, maintenance, communication, and adoption of cybersecurity policies, standards, and control expectations within assigned areas to promote ownership and consistent security practices.
- Lead or support risk and control activities, including identifying gaps, assessing impact, supporting risk decisions, and tracking remediation progress.
- Lead or support activities related to cybersecurity compliance obligations such as audits, assessments, evidence collection, issue management, and readiness for applicable regulatory and industry requirements.
- Partner across Cybersecurity, Technology, Legal, Audit, Privacy, Compliance, and business teams to align expectations, resolve issues, support risk-informed decisions, and drive accountability for assigned actions.
- Prepare and communicate outcome-focused reporting for assigned areas, covering risk, compliance, control performance, audit findings, remediation progress, and key decisions for leadership and stakeholders.
- Identify opportunities to improve processes, controls, documentation, metrics, and operating practices to strengthen transparency, consistency, accountability, and cybersecurity program maturity.
What you bring
- Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Business, Risk Management, Compliance, Audit, or a related discipline, or equivalent experience/training.
- Experience delivering and leading cybersecurity, information technology, risk management, compliance, audit, governance, or related activities.
- Bachelor’s degree in Information Security, Computer Science, or a related field; advanced degree preferred.
- 6+ years of experience in cybersecurity, information technology, risk management, compliance, audit, governance, or a closely related field preferred, and 3+ years of leadership experience.
- Experience leading cybersecurity governance, risk management, compliance, and control management enterprise programs, including setting priorities, defining outcomes, and improving program maturity.
- Experience overseeing security audits, assessments, control assurance activities, remediation governance, and executive reporting.
- Experience applying frameworks such as NIST, ISO 27001, PCI DSS, SOX, SOC 2, CMMC, GDPR, or similar standards.
- Experience evolving cybersecurity risk methodologies and analytical approaches, incorporating threat, exposure, control effectiveness, and business context.
- Strong knowledge of cybersecurity risk management, including risk identification and analysis, inherent and residual risk, risk scoring and prioritization, risk treatment and acceptance, risk appetite and tolerance, and risk/control frameworks.
- Strong understanding of risk and control management, including risk and control libraries, control effectiveness, issues and exceptions, risk acceptance, and remediation governance.
- Experience with third-party risk management practices, including supplier risk assessments, due diligence, control reviews, issue remediation, ongoing monitoring, and alignment of third-party cyber requirements to enterprise expectations.
- Strong understanding of risk metrics, analytics, and data, including translating cybersecurity and control data into meaningful indicators and trends for leadership decision support.
- Experience integrating or leveraging data across GRC platforms, enterprise data environments, security platforms, and reporting or visualization tools to improve risk measurement and insights.
- Experience with GRC platform engineering and enablement, including data models, integrations, workflows, automation, reporting, and platform evolution (platforms such as Archer, ServiceNow GRC/IRM, OneTrust, or similar are preferred).
- Working knowledge of cybersecurity and risk frameworks such as NIST CSF, NIST RMF, ISO 27001/27005, and other relevant industry frameworks.
- Strong leadership, communication, and stakeholder-management skills, including influencing decisions across Cybersecurity, Technology, enterprise risk, and business functions.
- Relevant professional certification such as CISSP, CRISC, CISM, or equivalent is preferred.
- Demonstrated ability to translate complex technical risks and data into clear business risk insights and recommendations for senior leaders and nontechnical stakeholders.
- Demonstrated ability to lead cross-functional teams and influence senior stakeholders across cybersecurity, technology, finance, legal, audit, privacy, compliance, and business teams.
- Ability to set strategic direction, define capability roadmaps, prioritize work, and align cyber products and services to enterprise risk, regulatory, and business objectives.
- Experience building, coaching, and developing high-performing teams, including setting expectations, strengthening accountability, and improving delivery across multiple workstreams.
Tools and technologies
- Archer
- ServiceNow GRC/IRM
- OneTrust
- NIST
- ISO 27001
- PCI DSS
- SOX
- SOC 2
- CMMC
- GDPR
- NIST Cybersecurity Framework (CSF)
- NIST Risk Management Framework (RMF)
- ISO 27005
- CISSP
- CRISC
- CISM
Role details
- Location: Fort Worth, TX (onsite)
- Experience: 6+ years (minimum preference)
- Type: Full-time
- Posted date: 11/06/2026
Benefits
- Travel Perks (365 destinations on more than 6,800 daily flights across the global network)
- Health Benefits
- Wellness Programs
- 401(k) Program
- Additional Benefits (Member Assistance Program, pet insurance, discounts on hotels, cars, cruises and more)
In this role, you will lead a specialized team shaping how American Airlines measures, prioritizes, and manages cyber risk across technology, applications, and third parties. The position brings together risk methodology, data and analytics, and GRC platform engineering to turn complex risk information into actionable insights, while evolving GRC platforms, workflows, automation, and reporting.
