OPT Risk And Compliance Jobs
Risk and Compliance jobs on OPT require employers who can support specialty occupation status, since most roles demand a degree in finance, law, business, or a related field. Your 12-month OPT window (29 months with STEM extension) is enough time to establish yourself and pursue H-1B visa sponsorship.
Find OPT Risk And Compliance JobsOverview
Showing 5 of 29+ Risk And Compliance jobs
See all Risk And Compliance Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Risk And Compliance roles.
Get Access To All JobsINTRODUCTION
Are you ready to explore a world of possibilities, both at work and during your time off? Join our American Airlines family, and you’ll travel the world, grow your expertise and become the best version of you. As you embark on a new journey, you’ll tackle challenges with flexibility and grace, learning new skills and advancing your career while having the time of your life. Feel free to enrich both your personal and work life and hop on board!
WHY YOU'LL LOVE THIS JOB
- As one diverse, high-performing team dedicated to technical excellence, you will focus relentlessly on delivering unrivaled digital products that drive a more reliable and profitable airline.
- As a Cybersecurity GRC Engineer/Sr. Engineer focused on Risk Management, you will help shape and advance cybersecurity risk management capabilities that translate technical risk into prioritized business decisions and action. You will apply expertise in cyber risk analysis, risk and control practices, risk intelligence, metrics, data, and GRC technology to strengthen how cybersecurity risks are identified, analyzed, treated, monitored, and communicated. You will have the opportunity to engineer scalable risk management practices and data-driven capabilities that help American anticipate evolving threats, technologies, regulatory expectations, and business needs.
As noted above, this list is intended to reflect the current job but there may be additional essential functions (and certainly non-essential job functions) that are not referenced. Management will modify the job or require other tasks be performed whenever it is deemed appropriate to do so, observing, of course, any legal obligations including any collective bargaining obligations.
- Apply Specialized GRC Expertise: Interpret cybersecurity frameworks, regulatory requirements, enterprise policies, risk methodologies, and control expectations to translate complex requirements into practical governance, risk, compliance, and portfolio management practices.
- Design and Mature GRC Processes and Control Practices: Develop, refine, and operationalize policies, standards, procedures, control mappings, assessment methods, evidence expectations, and governance routines that improve consistency, quality, and defensibility across cybersecurity activities.
- Perform Advanced Risk, Control, and Compliance Analysis: Evaluate risks, control gaps, compliance obligations, remediation plans, exceptions, issues, and supporting evidence to determine impact, root cause, prioritization, and appropriate risk response.
- Exercise Independent Technical Judgment: Develop recommendations, influence operating practices, and determine how GRC, portfolio, work management, and financial governance activities should be structured, measured, and executed to improve cyber risk outcomes.
- Lead Technical Execution for Assessments, Audits, and Regulatory Requests: Coordinate and execute control assessments, audit responses, evidence reviews, regulatory requests, testing activities, and issue validation by applying technical judgment to determine whether control design and operating effectiveness are supported.
- Build and Maintain Cyber Portfolio Operating Practices: Develop and manage work intake, prioritization methods, roadmaps, delivery plans, dependency tracking, decision logs, status reporting, portfolio health views, and execution routines that enable cybersecurity leaders to manage commitments and outcomes.
- Analyze Financial, Resource, and Delivery Information: Evaluate budgets, forecasts, run-rate trends, resource plans, vendor and contractor spend, purchase activity, and delivery commitments to identify gaps, tradeoffs, risks, and opportunities to improve portfolio decision-making.
- Develop Metrics, Insights, and Executive-Ready Reporting: Define, validate, analyze, and communicate cybersecurity, compliance, portfolio, financial, and operational metrics that support leadership visibility, risk-informed decisions, and measurable improvement.
- Serve as a Subject Matter Resource: Provide guidance to cybersecurity, technology, business, finance, sourcing, legal, privacy, and audit stakeholders on GRC requirements, control expectations, portfolio processes, work management practices, and financial governance activities.
- Drive Continuous Improvement and Automation Opportunities: Identify and implement improvements to workflows, tools, templates, data quality, reporting, documentation, and operating practices to increase efficiency, reduce manual effort, and improve the quality of GRC and portfolio management outcomes.
MINIMUM QUALIFICATIONS – EDUCATION & PRIOR JOB EXPERIENCE
- Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Business, Risk Management, Compliance, Audit, Finance, Data Analytics, Project/Portfolio Management, or a related technical or business discipline, or equivalent experience/training.
- Experience applying cybersecurity governance, risk, compliance, control, technology risk, audit, cyber portfolio management, work management, or financial management practices to interpret requirements, analyze information, coordinate execution, and support risk-informed stakeholder decisions.
- Experience working with cybersecurity, risk, compliance, control, portfolio, financial, resource, vendor, or delivery data to identify issues, assess impacts, track decisions, develop reporting, and contribute to process, control, or portfolio outcome improvement.
PREFERRED QUALIFICATIONS – EDUCATION & PRIOR JOB EXPERIENCE
- Advanced education, coursework, or specialized training in cybersecurity, information security, risk management, compliance, audit, information systems, data analytics, finance, project/portfolio management, or a related technical or business discipline preferred.
- Experience in a specialized cybersecurity governance, risk, compliance, cyber portfolio management, work management, audit, or technology risk role with ownership for interpreting requirements, designing or improving processes, and providing recommendations to stakeholders preferred.
- Experience applying cybersecurity, risk, compliance, and control frameworks such as NIST, ISO 27001, PCI DSS, SOX, SOC 2, CMMC, or similar standards to control mapping, assessments, evidence expectations, remediation activities, and governance practices preferred.
- Experience evaluating control design, operating effectiveness, risk impact, compliance gaps, exceptions, issues, remediation plans, and supporting evidence using structured analysis and technical judgment preferred.
- Experience developing or maturing GRC operating practices, control libraries, assessment methods, workflow routines, intake and prioritization models, portfolio roadmaps, dashboards, decision materials, or governance forums preferred.
- Experience analyzing cybersecurity portfolio, financial, vendor, contractor, resource, delivery, or work management data to identify trends, risks, tradeoffs, and recommendations preferred.
SKILLS, LICENSES, AND CERTIFICATIONS
- Deep working knowledge of cybersecurity risk management, including risk identification, analysis prioritization, treatment, monitoring, and communication. Strong understanding of cybersecurity controls and the relationship between threats vulnerabilities, controls, business impact, and risk.
- Experience developing or improving cybersecurity risk methodologies, assessment approaches, risk and control libraries, issue and exception practices, or risk treatment processes.
- Ability to analyze complex technical and business information, develop defensible risk conclusions, and translate cyber risk into clear priorities, recommendations, and actions.
- Experience developing risk metrics, key risk indicators, measurement approaches, and reporting that provide meaningful insight into cybersecurity risk and support risk-informed decisions.
- Working knowledge of cybersecurity and risk frameworks such as NIST Cybersecurity Framework, NIST Risk Management Framework, NIST SP 800-30, ISO 27001/27005, or comparable industry frameworks and methodologies.
- Experience using cybersecurity, risk, control, and related data to identify relationships, trends, concentrations, and insights that improve risk prioritization and decision-making.
- Working knowledge of data modeling, data quality, integration, analytics, or visualization concepts used to support cybersecurity risk intelligence and reporting.
- Experience using or improving GRC platforms and related workflows, integrations, automation, and reporting capabilities to strengthen risk management processes and data quality.
- Demonstrated curiosity and ability to evaluate and apply AI, automation, and emerging technologies to advance cybersecurity risk management, including identifying practical opportunities to improve risk analysis, intelligence, workflows, and team effectiveness.
- Demonstrated ability to independently translate objectives into structured approaches, manage complex work, exercise technical judgment, and drive high-quality outcomes with limited day-to-day oversight.
- Strong communication and advisory skills, including the ability to explain cyber risk, technical considerations, control implications, and recommendations to technical, business, and executive stakeholders.
- Demonstrated curiosity and ability to evaluate emerging cybersecurity, risk, data, and technology capabilities and translate relevant developments into practical improvements. Relevant cybersecurity or risk management certifications preferred, such as CRISC, CISSP, CISM, CISA, or comparable certifications.
WHAT YOU'LL GET
Feel free to take advantage of all that American Airlines has to offer:
- Travel Perks: Ready to explore the world? You, your family and your friends can reach 365 destinations on more than 6,800 daily flights across our global network.
- Health Benefits: On day one, you’ll have access to your health, dental, prescription and vision benefits to help you stay well. And that’s just the start, we also offer virtual doctor visits, flexible spending accounts and more.
- Wellness Programs: We want you to be the best version of yourself – that’s why our wellness programs provide you with all the right tools, resources and support you need.
- 401(k) Program: Available upon hire and, depending on the workgroup, employer contributions to your 401(k) program are available after one year.
- Additional Benefits: Other great benefits include our Member Assistance Program, pet insurance and discounts on hotels, cars, cruises and more.
FEEL FREE TO BE YOURSELF AT AMERICAN
From the team members we hire to the customers we serve, inclusion and diversity are the foundation of the dynamic workforce at American Airlines. Our 20+ Team Member Resource Groups are focused on connecting our team members to our customers, suppliers, communities and shareholders, helping team members reach their full potential and creating an inclusive work environment to meet and exceed the needs of our diverse world.
Are you ready to feel a tremendous sense of pride and satisfaction as you do your part to keep the largest airline in the world running smoothly as we care for people on life’s journey? Feel free to be yourself at American.
INTRODUCTION
Are you ready to explore a world of possibilities, both at work and during your time off? Join our American Airlines family, and you’ll travel the world, grow your expertise and become the best version of you. As you embark on a new journey, you’ll tackle challenges with flexibility and grace, learning new skills and advancing your career while having the time of your life. Feel free to enrich both your personal and work life and hop on board!
WHY YOU'LL LOVE THIS JOB
- As one diverse, high-performing team dedicated to technical excellence, you will focus relentlessly on delivering unrivaled digital products that drive a more reliable and profitable airline.
- As a Cybersecurity GRC Engineer/Sr. Engineer focused on Risk Management, you will help shape and advance cybersecurity risk management capabilities that translate technical risk into prioritized business decisions and action. You will apply expertise in cyber risk analysis, risk and control practices, risk intelligence, metrics, data, and GRC technology to strengthen how cybersecurity risks are identified, analyzed, treated, monitored, and communicated. You will have the opportunity to engineer scalable risk management practices and data-driven capabilities that help American anticipate evolving threats, technologies, regulatory expectations, and business needs.
As noted above, this list is intended to reflect the current job but there may be additional essential functions (and certainly non-essential job functions) that are not referenced. Management will modify the job or require other tasks be performed whenever it is deemed appropriate to do so, observing, of course, any legal obligations including any collective bargaining obligations.
- Apply Specialized GRC Expertise: Interpret cybersecurity frameworks, regulatory requirements, enterprise policies, risk methodologies, and control expectations to translate complex requirements into practical governance, risk, compliance, and portfolio management practices.
- Design and Mature GRC Processes and Control Practices: Develop, refine, and operationalize policies, standards, procedures, control mappings, assessment methods, evidence expectations, and governance routines that improve consistency, quality, and defensibility across cybersecurity activities.
- Perform Advanced Risk, Control, and Compliance Analysis: Evaluate risks, control gaps, compliance obligations, remediation plans, exceptions, issues, and supporting evidence to determine impact, root cause, prioritization, and appropriate risk response.
- Exercise Independent Technical Judgment: Develop recommendations, influence operating practices, and determine how GRC, portfolio, work management, and financial governance activities should be structured, measured, and executed to improve cyber risk outcomes.
- Lead Technical Execution for Assessments, Audits, and Regulatory Requests: Coordinate and execute control assessments, audit responses, evidence reviews, regulatory requests, testing activities, and issue validation by applying technical judgment to determine whether control design and operating effectiveness are supported.
- Build and Maintain Cyber Portfolio Operating Practices: Develop and manage work intake, prioritization methods, roadmaps, delivery plans, dependency tracking, decision logs, status reporting, portfolio health views, and execution routines that enable cybersecurity leaders to manage commitments and outcomes.
- Analyze Financial, Resource, and Delivery Information: Evaluate budgets, forecasts, run-rate trends, resource plans, vendor and contractor spend, purchase activity, and delivery commitments to identify gaps, tradeoffs, risks, and opportunities to improve portfolio decision-making.
- Develop Metrics, Insights, and Executive-Ready Reporting: Define, validate, analyze, and communicate cybersecurity, compliance, portfolio, financial, and operational metrics that support leadership visibility, risk-informed decisions, and measurable improvement.
- Serve as a Subject Matter Resource: Provide guidance to cybersecurity, technology, business, finance, sourcing, legal, privacy, and audit stakeholders on GRC requirements, control expectations, portfolio processes, work management practices, and financial governance activities.
- Drive Continuous Improvement and Automation Opportunities: Identify and implement improvements to workflows, tools, templates, data quality, reporting, documentation, and operating practices to increase efficiency, reduce manual effort, and improve the quality of GRC and portfolio management outcomes.
MINIMUM QUALIFICATIONS – EDUCATION & PRIOR JOB EXPERIENCE
- Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Business, Risk Management, Compliance, Audit, Finance, Data Analytics, Project/Portfolio Management, or a related technical or business discipline, or equivalent experience/training.
- Experience applying cybersecurity governance, risk, compliance, control, technology risk, audit, cyber portfolio management, work management, or financial management practices to interpret requirements, analyze information, coordinate execution, and support risk-informed stakeholder decisions.
- Experience working with cybersecurity, risk, compliance, control, portfolio, financial, resource, vendor, or delivery data to identify issues, assess impacts, track decisions, develop reporting, and contribute to process, control, or portfolio outcome improvement.
PREFERRED QUALIFICATIONS – EDUCATION & PRIOR JOB EXPERIENCE
- Advanced education, coursework, or specialized training in cybersecurity, information security, risk management, compliance, audit, information systems, data analytics, finance, project/portfolio management, or a related technical or business discipline preferred.
- Experience in a specialized cybersecurity governance, risk, compliance, cyber portfolio management, work management, audit, or technology risk role with ownership for interpreting requirements, designing or improving processes, and providing recommendations to stakeholders preferred.
- Experience applying cybersecurity, risk, compliance, and control frameworks such as NIST, ISO 27001, PCI DSS, SOX, SOC 2, CMMC, or similar standards to control mapping, assessments, evidence expectations, remediation activities, and governance practices preferred.
- Experience evaluating control design, operating effectiveness, risk impact, compliance gaps, exceptions, issues, remediation plans, and supporting evidence using structured analysis and technical judgment preferred.
- Experience developing or maturing GRC operating practices, control libraries, assessment methods, workflow routines, intake and prioritization models, portfolio roadmaps, dashboards, decision materials, or governance forums preferred.
- Experience analyzing cybersecurity portfolio, financial, vendor, contractor, resource, delivery, or work management data to identify trends, risks, tradeoffs, and recommendations preferred.
SKILLS, LICENSES, AND CERTIFICATIONS
- Deep working knowledge of cybersecurity risk management, including risk identification, analysis prioritization, treatment, monitoring, and communication. Strong understanding of cybersecurity controls and the relationship between threats vulnerabilities, controls, business impact, and risk.
- Experience developing or improving cybersecurity risk methodologies, assessment approaches, risk and control libraries, issue and exception practices, or risk treatment processes.
- Ability to analyze complex technical and business information, develop defensible risk conclusions, and translate cyber risk into clear priorities, recommendations, and actions.
- Experience developing risk metrics, key risk indicators, measurement approaches, and reporting that provide meaningful insight into cybersecurity risk and support risk-informed decisions.
- Working knowledge of cybersecurity and risk frameworks such as NIST Cybersecurity Framework, NIST Risk Management Framework, NIST SP 800-30, ISO 27001/27005, or comparable industry frameworks and methodologies.
- Experience using cybersecurity, risk, control, and related data to identify relationships, trends, concentrations, and insights that improve risk prioritization and decision-making.
- Working knowledge of data modeling, data quality, integration, analytics, or visualization concepts used to support cybersecurity risk intelligence and reporting.
- Experience using or improving GRC platforms and related workflows, integrations, automation, and reporting capabilities to strengthen risk management processes and data quality.
- Demonstrated curiosity and ability to evaluate and apply AI, automation, and emerging technologies to advance cybersecurity risk management, including identifying practical opportunities to improve risk analysis, intelligence, workflows, and team effectiveness.
- Demonstrated ability to independently translate objectives into structured approaches, manage complex work, exercise technical judgment, and drive high-quality outcomes with limited day-to-day oversight.
- Strong communication and advisory skills, including the ability to explain cyber risk, technical considerations, control implications, and recommendations to technical, business, and executive stakeholders.
- Demonstrated curiosity and ability to evaluate emerging cybersecurity, risk, data, and technology capabilities and translate relevant developments into practical improvements. Relevant cybersecurity or risk management certifications preferred, such as CRISC, CISSP, CISM, CISA, or comparable certifications.
WHAT YOU'LL GET
Feel free to take advantage of all that American Airlines has to offer:
- Travel Perks: Ready to explore the world? You, your family and your friends can reach 365 destinations on more than 6,800 daily flights across our global network.
- Health Benefits: On day one, you’ll have access to your health, dental, prescription and vision benefits to help you stay well. And that’s just the start, we also offer virtual doctor visits, flexible spending accounts and more.
- Wellness Programs: We want you to be the best version of yourself – that’s why our wellness programs provide you with all the right tools, resources and support you need.
- 401(k) Program: Available upon hire and, depending on the workgroup, employer contributions to your 401(k) program are available after one year.
- Additional Benefits: Other great benefits include our Member Assistance Program, pet insurance and discounts on hotels, cars, cruises and more.
FEEL FREE TO BE YOURSELF AT AMERICAN
From the team members we hire to the customers we serve, inclusion and diversity are the foundation of the dynamic workforce at American Airlines. Our 20+ Team Member Resource Groups are focused on connecting our team members to our customers, suppliers, communities and shareholders, helping team members reach their full potential and creating an inclusive work environment to meet and exceed the needs of our diverse world.
Are you ready to feel a tremendous sense of pride and satisfaction as you do your part to keep the largest airline in the world running smoothly as we care for people on life’s journey? Feel free to be yourself at American.
See all OPT Risk And Compliance Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new OPT Risk And Compliance Jobs.
Get Access To All JobsTips for Finding OPT Sponsorship in Risk And Compliance
Target regulated industries first
Banks, insurance firms, and healthcare companies maintain large compliance departments and file H-1B visa petitions regularly. Regulated industries have structural incentives to sponsor because replacing trained compliance staff mid-project is costly and disruptive.
Frame your degree as a specialty occupation requirement
Risk and compliance roles qualify as specialty occupations when the employer requires a specific degree. Emphasize your finance, accounting, law, or business degree in applications to reinforce that your background satisfies that requirement directly.
Pursue relevant certifications early
Credentials like FRM, CRCM, or CAMS signal long-term commitment to compliance as a profession. Employers are more likely to sponsor candidates who demonstrate they are building a career, not just filling a temporary role during OPT.
Ask about sponsorship before accepting offers
Compliance hiring timelines often run longer than your OPT authorization window. Confirming sponsorship willingness during the offer stage prevents you from investing months into a role that cannot support your visa status after OPT expires.
Highlight your knowledge of U.S. regulatory frameworks
Familiarity with frameworks like BSA, AML, SOX, or GDPR is a direct differentiator for OPT candidates. Employers hiring for U.S. compliance roles need staff who understand the local regulatory environment, not just general risk concepts.
Use STEM OPT strategically if your degree qualifies
Finance, management information systems, and some business analytics degrees qualify for the 24-month STEM extension. That extension gives you two additional H-1B lottery cycles, significantly improving your odds of securing long-term work authorization.
Risk And Compliance OPT: Frequently Asked Questions
Do Risk and Compliance jobs qualify as specialty occupations for OPT and H-1B purposes?
Most risk and compliance roles qualify as specialty occupations because they typically require a bachelor's degree or higher in a specific field such as finance, accounting, business, or law. The key is that the employer must require that specific degree for the position. Roles like compliance analyst, risk analyst, and AML investigator consistently meet this standard, which matters both for your OPT work authorization and for any future H-1B petition.
Which compliance roles are most likely to lead to H-1B sponsorship?
Roles in financial services compliance, AML and BSA compliance, model risk management, and regulatory affairs tend to attract the most sponsorship activity. Large banks, asset managers, and insurance companies file H-1B petitions for compliance staff regularly because retaining trained employees is operationally valuable. Searching Migrate Mate for risk and compliance positions lets you filter for employers who have sponsored visa holders in the past, which saves significant research time.
Can I work in compliance consulting on OPT?
Yes, but there are restrictions you need to understand. OPT requires that your employment is directly related to your degree field. Consulting arrangements are permitted as long as you have a formal engagement with a client, are paid by the employer of record, and the work aligns with your degree. Self-employment and independent contracting without a sponsoring employer are not permitted under standard F-1 OPT rules.
Does a compliance or risk management degree qualify for the STEM OPT extension?
It depends on how your specific degree is classified. Pure finance and accounting degrees do not typically qualify, but degrees in management information systems, financial engineering, data analytics, or quantitative risk management often appear on the DHS STEM designated degree list. Check your degree's CIP code against the official DHS STEM list and confirm with your DSO before assuming you qualify for the 24-month extension.
What should I do if my OPT expires before my employer files an H-1B petition?
If you are in cap-gap status because your employer filed an H-1B petition before your OPT expired, you are authorized to continue working until October 1 of that fiscal year. If no petition was filed in time, your employment authorization ends when OPT expires. In that scenario, options include changing to another nonimmigrant status, transferring to a cap-exempt employer, or departing the U.S. and returning on a different visa category if one applies to your situation.