Senior Cybersecurity Engineer - GRC Engineering & Technical Controls

What you’ll do

• Architect, build, and maintain data pipelines and middleware connecting GRC platforms with cloud environments, CMDBs, IAM tools, vulnerability scanners, and CI/CD pipelines.
• Develop custom connectors, automation scripts, and API-integrated workflows to automate controls testing and evidence gathering, reducing manual audit burdens.
• Standardize and codify security policies into machine-readable formats.
• Implement guardrails using cloud-native policy engines and automated infrastructure-as-code checking tools.
• Define, design, and configure automated verification routines to monitor control effectiveness in near real-time and flag configuration drift or compliance gaps.
• Develop and orchestrate AI-driven GRC workflows and agentic capabilities for automated risk assessments, control validation, and evidence classification.
• Design and integrate AI agents and LLM-powered pipelines with GRC platforms to streamline policy parsing, generate automated compliance scorecards, and provide intelligent remediation recommendations.
• Interpret global, regional, and industry-specific regulations (including privacy and automotive standards) and translate them into actionable, engineering-focused technical control standards.
• Maintain bidirectional traceability within a Unified Controls Framework (UCF) mapping regulatory obligations to engineering requirements, including NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, and vehicle cybersecurity regulations such as ISO/SAE 21434 and UN R155/R156.
• Conduct scheduled, event-driven, and automated technical audits to validate that control implementations meet regulatory and certification standards.
• Serve as the technical administrator and authority for the enterprise GRC / Integrated Risk Management (IRM) platform, including configuring advanced workflows, relational schemas, and API access.
• Establish and aggregate automated compliance telemetry (such as control coverage, deficiency aging, and real-time posture indicators) into executive-level dashboards.

What you’ll need

• Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Systems, or a related technical discipline (or equivalent practical experience).
• Minimum 7 years of progressive experience in a highly technical security environment, with strong focus on GRC engineering, security engineering, IT compliance, or DevSecOps.
• Hands-on programming experience with Python, Go, PowerShell, or Bash to build integrations, parse data, and interface with APIs.
• Hands-on experience or deep conceptual knowledge using AI agents, LLM APIs, and workflow orchestration frameworks to automate security and compliance tasks.
• Strong familiarity with Git-based workflows, CI/CD pipelines, and infrastructure governance tools, including knowledge of Policy-as-Code concepts.
• Practical knowledge of major security frameworks (such as NIST SP 800-53, ISO 27001, or SOC 2) and experience translating regulatory and certification requirements into technical controls.
• Practical knowledge of cloud infrastructure (AWS, Azure, or GCP), modern IAM models, vulnerability management architectures, and containerized deployments.
• At least one active, industry-recognized professional certification in risk, audit, or security engineering (examples: CISSP, CRISC, CISA, or CGRC).

Technologies you may work with

• Python, Go, PowerShell, Bash
• AI agents, LLM APIs, workflow orchestration frameworks
• Git, CI/CD pipelines
• Cloud-native policy engines, infrastructure-as-code checking tools
• AWS, Azure, GCP, IAM, containerized deployments
• GRC, Integrated Risk Management (IRM), CMDBs, vulnerability scanners
• Unified Controls Framework (UCF), NIST CSF, NIST SP 800-53, ISO 27001, SOC 2
• ISO/SAE 21434, UN R155/R156

Certifications

• Required: Holds at least one active, industry-recognized professional certification in risk, audit, or security engineering (e.g., CISSP, CRISC, CISA, or CGRC).
• Desired: Cloud or automation-focused technical certifications (e.g., CCSP, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, or GIAC Cloud Security Automation).

Hybrid work details

• This role is categorized as hybrid. The selected candidate is expected to report to the specific location at least 3 times a week (or other frequency dictated by their manager).
• This job is not eligible for relocation benefits; relocation costs are the responsibility of the selected candidate.
• GM does not provide immigration-related sponsorship for this role.

Benefits

Learn how GM supports a rewarding career that rewards you personally by visiting Total Rewards resources.