Megan Speranza

Megan Speranza

Vice President, Global Head of Resiliency Risk Management , American Express

Megan L. Speranza is an executive leader in enterprise risk management with over 20 years of experience across global financial institutions. She currently serves as the Head of Global Resiliency Risk Management Oversight at American Express, where she focuses on strengthening the firm’s resilience across people, processes, technology, third parties, and infrastructure.

Prior to joining American Express, Megan served as the Global Head of Compliance, Conduct, and Operational Resiliency Risk Oversight at JPMorgan Chase, leading operational resiliency risk frameworks spanningtechnology, cyber, third party, data, and site resilience. Previously, she directed Third-Party Risk Oversight at Citi and advanced operational continuity programs at Morgan Stanley. Megan is a Certified Third-Party Risk Professional, Lean Six Sigma Black Belt, and CPA.

1:20 pm - 3:35 pm

RESILIENCE UNDER STRESS- DESIGNING SEVERE-BUT-PLAUSIBLE THIRD-PARTY FAILURE SCENARIOS – SIMULATION LAB

A practitioner-led, closed-door simulation focused on how firms design and test severe-but-plausible third-party failure scenarios — not just document them. Expect open, peer-to-peer exchange on:

  • Designing joint testing exercises with critical vendors and key service providers
  • Stress-testing shared infrastructure and cloud dependencies under realistic conditions
  • Validating recovery timelines, fallback options, and manual workarounds
  • Simulating disruption across extended ecosystems beyond Tier 1 dependencies
  • Challenging assumptions that fail under real stress and identifying hidden vulnerabilities
Designed to move beyond frameworks into practical approaches you can take back and apply.

9:00 am - 9:50 am

OPERATIONAL RESILIENCE BEYOND BUSINESS CONTINUITY – PANEL DISCUSSION

Redefining resilience in the context of third-party failure.

  • Moving past 24–48 hour recovery assumptions
  • Designing severe-but-plausible scenarios involving vendors
  • Understanding realistic recovery timelines and workarounds
  • Embedding third-party failure into resilience frameworks