Information Security Compliance Analyst

About the role

Join the Governance, Risk & Compliance (GRC) team at Amex GBT as an Information Security Compliance Analyst. You will lead security awareness, phishing prevention, and policy governance programs that protect the organization and empower employees.

Key responsibilities

• Design, launch, and analyze phishing simulation campaigns, creating automated reporting and response mechanisms.
• Develop and manage a policy exception framework with standardized review, documentation, and tracking aligned to risk tolerance.
• Build and deliver a tiered security awareness curriculum using multi‑format materials and role‑specific learning paths.
• Maintain detailed audit trails to ensure compliance with NIST, ISO 27001, PCI DSS, and related frameworks.
• Monitor and update policy exceptions and access removals to reflect evolving risk posture.

Required profile

• 3–5 years of experience in information security, GRC, or security awareness.
• Proven ability to design and execute phishing simulations and produce trend analysis.
• Experience creating engaging, role‑based security training content.
• Strong background in managing security policy exceptions and audit documentation.
• Bachelor’s degree in Information Security, Information Systems, or related field (or equivalent experience).

Required skills

• Phishing simulation platforms: KnowBe4, Proofpoint, Adaptive Security.
• GRC workflow tools: Jira, ServiceNow, Onspring.
• Framework knowledge: NIST CSF, ISO 27001, PCI DSS, SOC2.
• Current CISSP or CISA certification preferred.

What we offer

• Flexible benefits tailored to Mexico, including health insurance, retirement programs, parental leave, adoption assistance, and wellbeing resources.
• Inclusive and collaborative culture that values employee voice.