Cloud Security Policy Cybersecurity Jobs

1 job found

Today

Senior Cybersecurity Engineer - GRC Engineering & Technical Controls

General Motors Warren, MI

Warren, MI

Today

Full time Senior Cloud Platform Cloud Platforms

Apply Now

Job Description

Opportunity to scale enterprise cybersecurity governance with automation. In this hybrid role at General Motors in Warren, MI, you will design and operate technical control frameworks that strengthen risk management, regulatory compliance, and control assurance across enterprise, cloud, connected vehicle, and operational technology environments. You will help build GRC engineering capabilities that reduce manual effort and improve visibility with automated workflows and executive-ready telemetry.

What you’ll do

Architect, build, and maintain data pipelines and middleware connecting GRC platforms with cloud environments, CMDBs, IAM tools, vulnerability scanners, and CI/CD pipelines.
Develop custom connectors, automation scripts, and API-integrated workflows to automate controls testing and evidence gathering, reducing manual audit burdens.
Standardize and codify security policies into machine-readable formats.
Implement guardrails using cloud-native policy engines and automated infrastructure-as-code checking tools.
Define, design, and configure automated verification routines to monitor control effectiveness in near real-time and flag configuration drift or compliance gaps.
Develop and orchestrate AI-driven GRC workflows and agentic capabilities for automated risk assessments, control validation, and evidence classification.
Design and integrate AI agents and LLM-powered pipelines with GRC platforms to streamline policy parsing, generate automated compliance scorecards, and provide intelligent remediation recommendations.
Interpret global, regional, and industry-specific regulations (including privacy and automotive standards) and translate them into actionable, engineering-focused technical control standards.
Maintain bidirectional traceability within a Unified Controls Framework (UCF) mapping regulatory obligations to engineering requirements, including NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, and vehicle cybersecurity regulations such as ISO/SAE 21434 and UN R155/R156.
Conduct scheduled, event-driven, and automated technical audits to validate that control implementations meet regulatory and certification standards.
Serve as the technical administrator and authority for the enterprise GRC / Integrated Risk Management (IRM) platform, including configuring advanced workflows, relational schemas, and API access.
Establish and aggregate automated compliance telemetry (such as control coverage, deficiency aging, and real-time posture indicators) into executive-level dashboards.

What you’ll need

Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Systems, or a related technical discipline (or equivalent practical experience).
Minimum 7 years of progressive experience in a highly technical security environment, with strong focus on GRC engineering, security engineering, IT compliance, or DevSecOps.
Hands-on programming experience with Python, Go, PowerShell, or Bash to build integrations, parse data, and interface with APIs.
Hands-on experience or deep conceptual knowledge using AI agents, LLM APIs, and workflow orchestration frameworks to automate security and compliance tasks.
Strong familiarity with Git-based workflows, CI/CD pipelines, and infrastructure governance tools, including knowledge of Policy-as-Code concepts.
Practical knowledge of major security frameworks (such as NIST SP 800-53, ISO 27001, or SOC 2) and experience translating regulatory and certification requirements into technical controls.
Practical knowledge of cloud infrastructure (AWS, Azure, or GCP), modern IAM models, vulnerability management architectures, and containerized deployments.
At least one active, industry-recognized professional certification in risk, audit, or security engineering (examples: CISSP, CRISC, CISA, or CGRC).

Technologies you may work with

Python, Go, PowerShell, Bash
AI agents, LLM APIs, workflow orchestration frameworks
Git, CI/CD pipelines
Cloud-native policy engines, infrastructure-as-code checking tools
AWS, Azure, GCP, IAM, containerized deployments
GRC, Integrated Risk Management (IRM), CMDBs, vulnerability scanners
Unified Controls Framework (UCF), NIST CSF, NIST SP 800-53, ISO 27001, SOC 2
ISO/SAE 21434, UN R155/R156

Certifications

Required: Holds at least one active, industry-recognized professional certification in risk, audit, or security engineering (e.g., CISSP, CRISC, CISA, or CGRC).
Desired: Cloud or automation-focused technical certifications (e.g., CCSP, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, or GIAC Cloud Security Automation).

Hybrid work details

This role is categorized as hybrid. The selected candidate is expected to report to the specific location at least 3 times a week (or other frequency dictated by their manager).
This job is not eligible for relocation benefits; relocation costs are the responsibility of the selected candidate.
GM does not provide immigration-related sponsorship for this role.

Benefits

Learn how GM supports a rewarding career that rewards you personally by visiting Total Rewards resources.

View full job page →

Get Cloud Security Policy Cybersecurity Jobs alerts

New Cloud Security Policy Cybersecurity Jobs, daily.