Senior Cybersecurity Engineer - GRC Engineering & Technical Controls

As a Senior Cybersecurity Engineer focused on GRC Engineering and Technical Controls, you will help General Motors advance enterprise cybersecurity risk management, regulatory compliance, and control assurance. The role designs, implements, and operates technical control frameworks that connect governance, risk, and compliance capabilities across cloud, connected vehicle, and operational technology environments.

Working in a hybrid setup from Warren, MI, you will lead initiatives to automate and scale evidence gathering, controls testing, and continuous assurance through integrated platforms, data pipelines, and policy-driven guardrails.

What you’ll do

• Architect, build, and maintain data pipelines and middleware connecting GRC platforms with cloud environments, CMDBs, IAM tools, vulnerability scanners, and CI/CD pipelines.
• Develop custom connectors, automation scripts, and API-integrated workflows to automate controls testing and evidence collection, reducing manual audit effort.
• Standardize and codify security policies into machine-readable formats.
• Implement guardrails using cloud-native policy engines and automated infrastructure-as-code checking tools.
• Define and configure automated verification routines to monitor control effectiveness in near real-time and flag configuration drift or compliance gaps.
• Develop and orchestrate AI-driven GRC workflows and agentic capabilities to automate risk assessments, control validation, and evidence classification.
• Design and integrate AI agents and LLM-powered pipelines with GRC platforms to streamline policy parsing, generate compliance scorecards, and support remediation recommendations.
• Interpret complex global, regional, and industry-specific regulations, including privacy and automotive standards, and translate them into engineering-focused technical control standards.
• Maintain bidirectional traceability within a Unified Controls Framework (UCF) mapping regulatory obligations to engineering requirements (including NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, and vehicle cybersecurity regulations such as ISO/SAE 21434 and UN R155/R156).
• Conduct scheduled, event-driven, and automated technical audits to validate control implementations against regulatory and certification standards.
• Serve as the technical administrator and authority for the enterprise GRC / Integrated Risk Management (IRM) platform.
• Configure advanced workflows, relational schemas, and API access to support GRC operations.
• Establish and aggregate automated compliance telemetry (for example, control coverage, deficiency aging, and real-time posture indicators) into executive-level dashboards.

Qualifications

• Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Systems, or a related technical discipline (or equivalent practical experience).
• Minimum 7 years of progressive experience in a highly technical security environment, with strong focus on GRC engineering, security engineering, IT compliance, or DevSecOps.
• Hands-on programming experience with Python, Go, PowerShell, or Bash for integrations, data parsing, and API interaction.
• Hands-on experience or deep conceptual knowledge of leveraging AI agents, LLM APIs, and workflow orchestration frameworks to automate security and compliance tasks.
• Strong understanding of Git-based workflows, CI/CD pipelines, and infrastructure governance tools, including familiarity with Policy-as-Code.
• Practical knowledge of major security frameworks such as NIST SP 800-53, ISO 27001, or SOC 2, including translating regulatory or certification requirements into technical controls.
• Practical knowledge of cloud infrastructure (AWS, Azure, or GCP), modern IAM models, vulnerability management architectures, and containerized deployments.
• At least one active, industry-recognized professional certification in risk, audit, or security engineering (examples include CISSP, CRISC, CISA, or CGRC).

Technologies

• Python, Go, PowerShell, Bash
• AI agents, LLM APIs, workflow orchestration frameworks
• Git, CI/CD pipelines, cloud-native policy engines
• Infrastructure-as-code checking tools
• AWS, Azure, GCP, IAM, containerized deployments
• GRC, Integrated Risk Management (IRM), CMDBs, vulnerability scanners
• Unified Controls Framework (UCF), NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, ISO/SAE 21434, UN R155/R156

Benefits

Learn how GM supports a rewarding career that rewards you personally by visiting Total Rewards resources.

Preferred qualifications

• Direct experience building machine-readable compliance, automated controls testing, policy engine integration, or continuous assurance programs.
• Experience designing, configuring, and maintaining automated guardrails, automated evidence collection routines, and configuration drift detection in production environments.
• Prior experience adapting unified control structures to map to complex automotive, vehicle safety, or international privacy standards.
• Prior experience customizing and deep-configuring market-leading GRC/IRM platforms via custom APIs, database schemas, and workflows.

Professional certifications

• Required: Holds at least one active, industry-recognized professional certification in risk, audit, or security engineering (examples include CISSP, CRISC, CISA, or CGRC).
• Desired: Cloud or automation-focused technical certifications (examples include CCSP, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, or GIAC Cloud Security Automation).

Hybrid / relocation / immigration

• This role is categorized as hybrid, requiring the selected candidate to report to a specific location at least 3 times a week or at a frequency set by the manager.
• This role is not eligible for relocation benefits, and relocation costs would be the responsibility of the selected candidate.
• GM does not provide immigration-related sponsorship for this role.