Compliance Analyst – Global Risk & Compliance Organization (GRC)
About the Global Risk & Compliance Organization
The Global Risk & Compliance Organization (GRC) is an independent risk management function led by the Chief Risk Officer. Its mission is to ensure that American Express operates in a safe, sound, and fully compliant manner while meeting all applicable regulatory requirements and expectations.
GRC establishes and maintains the enterprise-wide risk management framework, conducts independent risk assessments, and provides oversight to identify, monitor, and manage risks across the organization.
How will you make an impact in this role?
At GRC, we are committed to supporting the Company’s growth and strategic objectives by fostering a strong culture of risk awareness, accountability, and proactive regulatory compliance. By partnering closely with business units across the enterprise, we help protect our customers, support sustainable business growth, and deliver long-term value to shareholders through effective risk management and oversight.
Key Responsibilities
Act as a trusted advisor to business stakeholders across Privacy, Merchant, and Corporate and Staff BUs functions, providing risk-based compliance guidance on business initiatives, strategic projects, products, and operational changes.
Perform independent compliance and privacy risk assessments to identify regulatory, operational, and conduct risks, recommending appropriate mitigation strategies and controls.
Provide effective challenge to business decisions, risk assessments, and control designs to ensure compliance risks are appropriately identified and managed.
Support the implementation and continuous enhancement of the Privacy and Compliance programs in alignment with applicable laws, regulations, and internal policies.
Partner with Legal, Information Security, Risk Management, Technology, HR, Merchant and Corporate teams to ensure regulatory requirements are incorporated into business processes.
Assess regulatory changes related to Privacy, Data Protection, Merchant, and Corporate activities, evaluating business impact and supporting implementation plans.
Review new products, initiatives, vendors, technologies, and business processes from a compliance and privacy perspective.
Support Privacy Impact Assessments (PIAs/DPIAs), third-party risk reviews, data lifecycle assessments, and governance activities where applicable.
Perform monitoring and testing activities to evaluate compliance with privacy obligations, internal policies, and regulatory requirements.
Support internal audits, regulatory examinations, compliance reviews, and remediation efforts.
Maintain compliance and privacy documentation, including risk assessments, inventories, procedures, evidence of controls, and governance records.
Develop metrics, dashboards, and management reports to communicate compliance and privacy risk exposure.
Deliver awareness sessions and training related to Compliance, Privacy, and ethical business conduct.
Promote a strong culture of integrity, accountability, risk awareness, and data protection across the organization.
Support additional Compliance and Privacy initiatives based on business priorities.
Minimum Qualifications
Full professional fluency in English and Spanish (written and spoken).
Strong analytical, critical-thinking, and problem-solving skills, with an enterprise-wide perspective.
Excellent verbal and written communication skills, with strong influencing and negotiation capabilities.
Strong organizational skills, with the ability to manage multiple priorities in a fast-paced, deadline-driven environment.
High attention to detail and strong execution capabilities.
Collaborative team player with the ability to build strong cross-functional relationships.
Demonstrated ability to work effectively within a complex matrix organization.
Professional maturity, sound judgment, and confidence in presenting and defending recommendations to senior management.
Proven ability to influence and challenge stakeholders across business lines and support functions when appropriate.
Strong stakeholder management, relationship-building, and interpersonal skills.
Advanced proficiency in Microsoft Excel, PowerPoint, and other business productivity tools.
Preferred Qualifications
Bachelor’s degree in Law, Business Administration, Finance, Economics, Accounting, or a related field.
1–3+ years of experience in Compliance, Risk Management, Internal Audit, Legal, Regulatory Affairs, Internal Controls, or related functions.
Knowledge of the Mexican regulatory and compliance environment.
Experience supporting or partnering with the International Card Services (ICS) and/or Merchant Services (GMS) businesses.
Experience supporting American Express operations.
Knowledge of compliance risk management frameworks and regulatory compliance principles.
Familiarity with compliance management systems, governance platforms, workflow tools, or regulatory change management processes.
Understanding of conduct risk, governance frameworks, and compliance monitoring methodologies.
Professional certifications such as CRCM, CAMS, CCEP, or equivalent are a plus.
Data Privacy regulations (GDPR, LGPD, LFPDPPP u otras aplicables).
Privacy by Design.
Privacy Impact Assessments (PIA/DPIA).
Certificaciones como CIPP/E, CIPP/US, CIPM, CCEP, CRCM o equivalentes.
Leadership & Behavioral Competencies
Demonstrates the highest standards of integrity, ethics, and professionalism.
Exercises independent judgment and a risk-based decision-making approach.
Ability to challenge constructively while maintaining strong business relationships.
Proactive, adaptable, and comfortable navigating ambiguity and change.
Strong learning agility and intellectual curiosity regarding evolving regulatory requirements and industry developments.
Commitment to fostering a culture of compliance, accountability, and continuous improvement.