Analyst - Control Management (International Operational Resilience)

ICS Governance & Control sits within International Card Services (ICS) which comprises of all the issuing functions across all 28 international markets excluding the US - colleagues operate across a variety of geographies and disciplines. ICS issues products to our Consumer and Commercial customers – the organization is an integral part of the global growth strategy for American Express; offering differentiated products and services is critical to our success and promises to drive significant growth and value through the delivery of innovative products, tailored to the needs of our customers.

The objective of the ICS Control Management Risk ID, Assessment, Testing and Reporting team is to identify, assess, mitigate, and report on Operational Risk within BU processes for ICS to ensure adherence to regulatory standards, Amex policy and enhance the BU's resilience through managing a clear methodology of inherent and residual risk.

ICS Control Management is looking for an Analyst of Risk ID, Assessment, Testing & Reporting focused on ensuring control management is embedded in the day-to-day operations of our organization. It will involve extensive collaboration with multiple partners across numerous business units, functional areas, and geographies.

The Analyst, International Operational Resilience, ICS Control Management will

• Assist in managing International Operational Resiliency risk by supporting development of Operational Resiliency Framework / Standard for international markets
• Support in US to international operational resiliency risk policy/ framework gap assessment
• Support in providing international business requirements into Unified Source of record (SOR) for resiliency
• Support maintenance of integrated international resiliency inventory including applications and third parties
• Assist in additional identification specific risks throughout business processes and systems (along with business process owners)
• Support facilitation to BUs in their risk assessments performance (e.g., Process Self Risk Assessments (PRSAs)) in addition to further assessments and testing / QA programs to ensure regulatory and internal standards are met (e.g., periodic PRSA reviews and update assessment criteria to align with regulatory updates)
• Support control monitoring (supplemental to BU process owners testing) and compile key operational risk trends, activities, and events
• Proactively help identify certain areas of high-risk for intervention (e.g., automated alerts generated for high-risk areas signal need for intervention and focus), including conducting independent quality assurance and vertical process testing
• Support thematic risk reporting (levels, trends, causes)
• Categorize controls and map against risks and processes (e.g., cross-BU process-control mapping)
• Support risk management practices within the business
• Maintain risk dashboards and key risk indicators (KRIs) for ongoing monitoring
• Maintain risk profiles and an updated risk register(s)
• Support sharing insights, better practices, themes, etc. across the enterprise

Required Qualifications:

• 2-3 Years experience in operational risk management (e.g., within Risk and/or Internal Audit function) Understanding of critical operational risk management lifecycle activities

• Project management, communication, and interpersonal skills

• Experience in process governance, with an understanding of processes that align with policies, regulatory frameworks, and/or operational standards

• Analytical and problem-solving skills, with an ability to analyze data, identify trends, and evaluate risk scenarios effectively

Preferred Qualifications:

• Bachelor's Degree in Finance, Business, Risk Mgmt., or related field; advanced degrees (e.g., MBA, MSc) or certifications are advantageous

• Experience in at least one of the following:

  • Supporting identification of operational risks throughout business processes and systems

  • Facilitating risk assessment performance in addition to further assessments and testing programs to ensure regulatory and internal standards are met

  • Supporting independent control monitoring, including identification of control improvements

  • Supporting the identification of areas of risk for intervention, including conducting independent quality assurance and process testing

  • Compiling thematic risk reporting to provide actionable insights on risk levels, emerging trends and root causes