Senior Cybersecurity Engineer - GRC Engineering & Technical Controls

General Motors•Warren, MI

2d•Hybrid

About The Position

The Senior Cybersecurity Engineer - GRC Engineering & Technical Controls advances enterprise cybersecurity risk management, regulatory compliance, and control assurance through governance expertise and engineering-driven solutions. The role designs, implements, and operates technical control frameworks; conducts risk and compliance assessments; and partners with engineering teams to implement, validate, and continuously monitor security controls across enterprise, cloud, connected vehicle, and operational technology environments. The position leads GRC engineering initiatives to automate and scale governance, risk, and compliance capabilities, including Continuous Control Monitoring (CCM), Compliance-as-Code, Policy-as-Code, automated evidence collection, control validation, workflow orchestration, and AI-enabled governance processes. It translates regulatory, contractual, cybersecurity, privacy, and vehicle cybersecurity requirements into actionable technical controls and measurable assurance activities, integrating GRC platforms with security technologies, cloud services, and enterprise systems. The engineer also develops GRC data pipelines and integrations, automates evidence gathering and control testing, implements machine-readable policies and automated guardrails, and creates near-real-time control monitoring. The role applies AI-driven workflows to risk assessments, control validation, evidence classification, policy parsing, compliance scorecards, and remediation recommendations. It interprets regulations and maintains traceability between regulatory obligations and common engineering requirements, conducts technical control audits, administers the enterprise GRC/IRM platform, and delivers compliance telemetry and executive dashboards. This is a hybrid role. The selected candidate is expected to report to a specific location at least three times a week or at another frequency set by their manager. The role is not eligible for relocation benefits. GM does not provide immigration-related sponsorship for this role.

Requirements

Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Systems, or a related technical discipline, or equivalent practical experience.
At least 7 years of progressive experience in a highly technical security environment, focused on GRC engineering, security engineering, IT compliance, or DevSecOps.
Strong hands-on programming experience with Python, Go, PowerShell, or Bash for integrations, data parsing, and API interfaces.
Hands-on experience or deep conceptual knowledge of AI agents, LLM APIs, and workflow orchestration frameworks for security and compliance automation.
Solid understanding of Git-based workflows, CI/CD pipelines, and infrastructure governance tools; familiarity with Policy-as-Code concepts.
Strong practical knowledge of security frameworks such as NIST SP 800-53, ISO 27001, or SOC 2, and experience translating regulatory or certification requirements into technical controls.
Practical knowledge of cloud infrastructure (AWS, Azure, or GCP), modern IAM models, vulnerability management architectures, and containerized deployments.
At least one active, industry-recognized professional certification in risk, audit, or security engineering, such as CISSP, CRISC, CISA, or CGRC.
Must not require GM immigration sponsorship now or in the future.

Nice To Haves

Direct experience building and implementing machine-readable compliance, automated control testing, policy engine integrations, or continuous assurance programs.
Experience designing, configuring, and maintaining automated guardrails, evidence collection routines, and configuration drift detection in production environments.
Experience adapting unified control structures to complex automotive, vehicle safety, or international privacy standards.
Experience customizing and deeply configuring market-leading GRC/IRM platforms using custom APIs, database schemas, and workflows.
Cloud or automation-focused technical certifications, such as CCSP, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, or GIAC Cloud Security Automation.

Responsibilities

Architect, build, and maintain data pipelines and middleware connecting GRC platforms with cloud environments, CMDBs, IAM tools, vulnerability scanners, and CI/CD pipelines.
Develop custom connectors, automation scripts, and API-integrated workflows to automate control testing and evidence gathering.
Standardize and codify security policies into machine-readable formats and implement guardrails using cloud-native policy engines and infrastructure-as-code checking tools.
Define, design, and configure Continuous Control Monitoring routines to verify control effectiveness and flag configuration drift or compliance gaps.
Develop and orchestrate AI-driven GRC workflows and agentic capabilities for risk assessments, control validation, and evidence classification.
Integrate AI agents and LLM-powered pipelines with GRC platforms to streamline policy parsing, generate compliance scorecards, and recommend remediation.
Interpret global, regional, and industry-specific regulations and translate them into engineering-focused technical control standards.
Maintain bidirectional traceability in a Unified Controls Framework, mapping regulatory obligations to common engineering requirements and frameworks.
Conduct scheduled, event-driven, and automated technical audits to validate control implementations against regulatory and certification standards.
Administer the enterprise GRC/IRM platform, including configuring workflows, relational schemas, and API access.
Establish and aggregate automated compliance telemetry, including control coverage, deficiency aging, and posture indicators, into executive-level dashboards.