Senior Manager Data Risk Management - Data Governance & Management

The Commercial Data Office (CoDO) team, within Global Commercial Services (GCS), is focused on powering the best customer experience and driving value through data. With continuous changes in the regulatory environment and data innovation, CoDO plays a key role in supporting GCS’ sustainable growth balanced with controls and risk management. In partnership with the Enterprise Data Office and across GCS, CoDO is tasked with building new, innovative data solutions for our customers and leading the program for adherence to data regulations and data management best practices.

How will you make an impact in this role?

As the Senior Manager of the Commercial Data Risk Management team, you will lead critical Data Risk Management priorities for GCS and partner with the American Express Enterprise Data Office, GCS Control Management (First Line Risk), Enterprise Business Architecture team, and Business, Product and Technology teams to execute enterprise Data Risk policies and standards. You will translate enterprise requirements into scalable GCS Controls and capabilities, strengthen the control environment, drive remediation of material data risk gaps and issues, and provide risk insights and recommendations to senior leadership. The role requires strong strategic thinking, execution leadership, cross-functional influence, and the ability to operate effectively across complex business and technology environments. 

Minimum Qualifications

• 5+ years of experience in Data Risk Management, Operational Risk, Data Governance, Controls, or a related discipline within financial services/banking, with hands on risk management experience across RCSA (Risk Identification & Assessment), Issue Management, control design/testing, remediation, and risk monitoring. 
• Proven ability to translate complex business strategies, processes, and technology environments into Data Risk implications, control requirements, and actionable solutions, with strong analytical, problem-solving, and decision-making capabilities. 
• Demonstrated leadership and influence across cross-functional teams, including Business, Product, Technology, First & Second line Risk & Compliance functions, Audit, and Data organizations, with a proven ability to drive outcomes without direct authority. 
• Strong executive communication and strategic execution skills, with the ability to synthesize complex risk topics, provide clear recommendations to senior leaders, manage competing priorities, and navigate complex dependencies. 
• Enterprise mindset with the ability to connect GCS Risk & Compliance priorities to broader enterprise objectives while balancing stakeholder needs; Bachelor’s degree in a relevant technical, or business discipline. Top of Form

Bottom of Form

Preferred Qualifications

• Experience across key Data Risk domains, such as Retention & Deletion/Records Management, Data Sharing Risk, Data Architecture, and enterprise Data Risk frameworks; understanding of relevant data privacy and protection requirements preferred. 
• Experience with Data Governance, GRC, risk-management, analytics, or reporting tools and applying them to strengthen risk monitoring and governance.

• Drive GCS Data Risk strategy and priorities, translating enterprise policies, standards, architecture, and emerging requirements into practical, scalable risk management capabilities across GCS processes, products, and applications. 
• Lead Data Risk assessment, controls, and RCSA integration, providing senior SME guidance on risk identification, applicability, control design/mapping, ownership, effectiveness, and opportunities to standardize and automate controls. 
• Drive sustainable remediation of Data Risk issues and deficiencies, partnering with Issue/Corrective Action Owners, Control Management, Business, Product, and Technology teams to address root causes, strengthen controls, and reduce recurrence. 
• Lead Retention & Deletion governance and proactive risk monitoring, including risk/control indicators, dashboards, and executive reporting.
• Integrate Data Risk with EBCM/Business Architecture, connecting business capabilities to RCSA risks and controls, establishing two-way visibility between EBCM and Data Risk activities, and using capability insights to identify dependencies, gaps, and remediation priorities. 
• Build strong cross-functional partnerships and Data Risk culture across CoDO, EDO, Risk, Control Management, EBCM, Business, Product, Technology, and Architecture—driving alignment, resolving complex dependencies, and promoting sustainable risk management through leadership engagement, consultation, and awareness.