Senior Cybersecurity Engineer - GRC Engineering & Technical Controls
General Motors6 days ago
Warren, MI, USASenior
Responsibilities
- Architect, build, and maintain APIs, data pipelines, middleware, connectors, and workflows linking GRC platforms with cloud environments, CMDBs, IAM tools, vulnerability scanners, and CI/CD pipelines.
- Automate controls testing, evidence gathering, compliance assessments, and technical audit validation through scripts, integrations, and event-driven monitoring.
- Develop policy-as-code standards, cloud-native guardrails, infrastructure-as-code checks, continuous control monitoring, and configuration-drift detection.
- Develop AI-driven GRC workflows, AI agents, LLM-powered pipelines, automated compliance scorecards, evidence classification, and remediation recommendations.
- Translate regulatory, contractual, privacy, cybersecurity, and vehicle cybersecurity requirements into technical control standards.
- Maintain bidirectional mappings between regulatory obligations and unified engineering controls across NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, ISO/SAE 21434, and UN R155/R156.
- Serve as technical administrator and authority for the enterprise GRC/IRM platform, including workflows, schemas, and API access.
- Build compliance telemetry and executive dashboards covering control coverage, deficiency aging, and security posture indicators.
Requirements
- Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Systems, or a related technical discipline, or equivalent practical experience.
- At least 7 years of progressive experience in a highly technical security environment focused on GRC engineering, security engineering, IT compliance, or DevSecOps.
- Strong hands-on programming experience with Python, Go, PowerShell, or Bash for integrations, data parsing, and API access.
- Hands-on experience or deep conceptual knowledge of AI agents, LLM APIs, and workflow orchestration frameworks for security and compliance automation.
- Understanding of Git-based workflows, CI/CD pipelines, infrastructure governance tools, and policy-as-code concepts.
- Practical knowledge of major security frameworks such as NIST SP 800-53, ISO 27001, or SOC 2 and experience translating requirements into technical controls.
- Knowledge of AWS, Azure, or GCP cloud infrastructure, modern IAM models, vulnerability management architectures, and containerized deployments.
- Experience with compliance-as-code, automated control testing, policy engine integration, continuous assurance, automated guardrails, evidence collection, and configuration-drift detection is preferred.
- Experience mapping unified control structures to automotive, vehicle safety, or international privacy standards is preferred.
- Experience customizing and configuring GRC/IRM platforms through APIs, database schemas, and workflows is preferred.
- An active industry-recognized professional certification in risk, audit, or security engineering is required, such as CISSP, CRISC, CISA, or CGRC.
- Cloud or automation certifications such as CCSP, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, or GIAC Cloud Security Automation are desired.
Benefits
- Hybrid work arrangement requiring onsite reporting at least three times per week or at another frequency specified by the manager.
- Benefits are available from day one and include General Motors’ Total Rewards resources supporting employee well-being.
- The role is not eligible for relocation benefits; relocation costs are the selected candidate’s responsibility.
About General Motors
General Motors designs, manufactures, and sells cars, trucks, and electric vehicles for consumers and commercial fleets under brands including Chevrolet, GMC, Cadillac, and Buick. A public company on the NYSE headquartered in Detroit and founded in 1908, it operates globally and is developing EVs on its Ultium battery platform. Revenue comes from vehicle and parts sales, connected services such as OnStar, and financing through GM Financial.