Senior Cybersecurity Engineer - GRC Engineering & Technical Controls

GM•Warren, MI

1d•Hybrid

About The Position

The Senior Cybersecurity Engineer - GRC Engineering & Technical Controls advances enterprise cybersecurity risk management, regulatory compliance, and control assurance through governance expertise and engineering-driven solutions. The role designs, implements, and operates technical control frameworks; conducts risk and compliance assessments; and partners with engineering teams to implement, validate, and continuously monitor controls across enterprise, cloud, connected vehicle, and operational technology environments. The engineer leads initiatives to automate and scale governance, risk, and compliance capabilities, including Continuous Control Monitoring, Compliance-as-Code, Policy-as-Code, automated evidence collection, control validation, workflow orchestration, and AI-enabled governance. The role translates regulatory, contractual, cybersecurity, privacy, and vehicle cybersecurity requirements into technical controls and measurable assurance activities, while integrating GRC platforms with security technologies, cloud services, and enterprise systems. The role also builds GRC integrations and data pipelines; develops automated evidence and control-testing workflows; codifies policies and implements automated guardrails; creates AI-driven workflows and decision support; maps regulatory obligations to unified controls; validates controls; administers the enterprise GRC/IRM platform; and delivers compliance telemetry and executive dashboards. This position is categorized as hybrid, with the selected candidate expected to report to a specific location at least three times a week or at another frequency set by the manager. The role is not eligible for relocation benefits. GM does not provide immigration-related sponsorship for this role.

Requirements

Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Systems, or a related technical discipline, or equivalent practical experience.
At least 7 years of progressive experience in a highly technical security environment, focused on GRC engineering, security engineering, IT compliance, or DevSecOps.
Hands-on programming experience with Python, Go, PowerShell, or Bash for building integrations, parsing data, and interfacing with APIs.
Hands-on experience or deep conceptual knowledge of AI agents, LLM APIs, and workflow orchestration frameworks for automating security and compliance tasks.
Understanding of Git-based workflows, CI/CD pipelines, and infrastructure governance tools, with familiarity with Policy-as-Code concepts.
Practical knowledge of major security frameworks such as NIST SP 800-53, ISO 27001, or SOC 2, and experience translating regulatory or certification requirements into technical controls.
Practical knowledge of cloud infrastructure (AWS, Azure, or GCP), modern IAM models, vulnerability management architectures, and containerized deployments.
At least one active, industry-recognized professional certification in risk, audit, or security engineering, such as CISSP, CRISC, CISA, or CGRC.

Nice To Haves

Direct experience building and implementing machine-readable compliance, automated controls testing, policy engine integration, or continuous assurance programs.
Experience designing, configuring, and maintaining automated guardrails, automated evidence collection routines, and configuration drift detection in production environments.
Experience adapting unified control structures to complex automotive, vehicle safety, or international privacy standards.
Experience customizing and deep-configuring GRC/IRM platforms through custom APIs, database schemas, and workflows.
Cloud- or automation-focused technical certifications, such as CCSP, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, or GIAC Cloud Security Automation.

Responsibilities

Architect, build, and maintain data pipelines and middleware connecting GRC platforms with cloud environments, CMDBs, IAM tools, vulnerability scanners, and CI/CD pipelines.
Develop custom connectors, automation scripts, and API-integrated workflows to automate control testing and evidence gathering.
Standardize and codify security policies into machine-readable formats, and implement guardrails using cloud-native policy engines and automated infrastructure-as-code checking tools.
Define, design, and configure Continuous Control Monitoring routines that monitor control effectiveness and flag configuration drift or compliance gaps.
Develop and orchestrate AI-driven GRC workflows and agentic capabilities to automate risk assessments, control validation, and evidence classification.
Design and integrate AI agents and LLM-powered pipelines with GRC platforms to streamline policy parsing, generate compliance scorecards, and provide remediation recommendations.
Interpret global, regional, and industry-specific regulations, including privacy and automotive standards, and translate them into technical control standards.
Maintain bidirectional traceability in a Unified Controls Framework, mapping regulatory obligations to common engineering requirements and frameworks.
Conduct scheduled, event-driven, and automated technical audits to validate control implementations against regulatory and certification standards.
Serve as technical administrator and authority for the enterprise GRC/IRM platform, configuring workflows, relational schemas, and API access.
Establish and aggregate automated compliance telemetry, including control coverage, deficiency aging, and real-time posture indicators, into executive-level dashboards.