Senior Security Software Engineer, Advanced Security

GM • Warren, MI

10d • Hybrid

About The Position

General Motors’ Advanced Security Engineering team develops security capabilities to reduce real security exposure. The team uses AI to strengthen defenses, validate weaknesses, and support authorized offensive security testing in controlled environments. By combining security findings with code, cloud, and runtime context, the team identifies issues that are real and reachable and helps deliver remediation, mitigation, or detection.

The Senior Security Software Engineer will design, build, and operate cloud services and AI agents supporting this work. These systems analyze untrusted code, handle sensitive security data, and provide agents controlled access to security tools and computing environments. Safely designing that access is a core aspect of the position.

As a senior individual contributor, the engineer works independently with minimal guidance, turns broad challenges into practical solutions, and owns delivery across team boundaries. The role involves evaluating options, exercising sound technical judgment with limited information, and bringing work through review at key decision points. The engineer is accountable for the reliability, security, and cost of delivered systems, helps shape a new team and its capabilities, collaborates with security specialists, and mentors other engineers.

The role is categorized as hybrid, with the selected candidate expected to report to a specific location at least three times per week or at another frequency set by their manager. Relocation benefits are available to candidates who qualify under company policy. GM does not provide immigration-related sponsorship for this role.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related field, or equivalent practical experience.
• At least 5 years of experience in software engineering, cloud engineering, or security engineering.
• Strong experience writing production Python.
• Experience with infrastructure as code, such as Terraform, and CI/CD on a major cloud platform.
• Working knowledge of application security, including common vulnerability classes, how security scanners work, and where they produce false positives.
• Experience building secure systems using least privilege, secrets management, isolation, and safe handling of untrusted input.
• Ability to own work across teams, make sound decisions with limited information, and explain technical risk to people who are not security specialists.
• Experience using agentic LLM tools and solutions.

Nice To Haves

• Experience building applications with large language models and agent frameworks, including tool use and output evaluation.
• Experience with containers and Kubernetes.
• Experience with sandboxing and isolation, or securing systems that execute untrusted code.
• Experience with static or program analysis, such as writing Semgrep or CodeQL rules.
• Experience in vulnerability research, penetration testing, or exploit development.
• Familiarity with AI security risks and controls, such as the OWASP Top 10 for LLM Applications.
• Public examples of shipped work, such as open-source contributions, published tools, or technical write-ups.

Responsibilities

• Design, build, and operate production cloud services in Python, including containerized workloads, event-driven processing, and data storage.
• Define and manage supporting infrastructure as code.
• Integrate findings and context from security tools, source control, and cloud APIs.
• Build AI agents that triage findings, gather evidence from source code and cloud configuration, and propose fixes.
• Build and harden sandboxed environments for AI-enabled testing of authorized targets.
• Apply defense in depth, accounting for the possibility that any individual containment boundary can fail.
• Control agent access through isolation, least-privilege identities, network egress limits, and secrets management.
• Separate agents that produce results from agents that verify them.
• Treat source code, tool output, and model responses as untrusted input; defend against prompt injection and keep sensitive data out of prompts and logs.
• Evaluate model accuracy, cost, and latency to inform model selection and detect regressions.
• Use evidence to explain technical trade-offs and guide improvements to owned systems.
• Partner with application security, penetration testing, and cloud security engineers to turn expert judgment into repeatable checks and deliver solutions across teams.
• Communicate technical risks and recommendations to non-specialists.
• Review code and mentor less-experienced engineers through constructive feedback and collaborative problem-solving.

Benefits

• Relocation benefits are available for candidates who qualify under company policy.
• GM describes well-being support at work and at home; specific benefits are referred to in its Total Rewards resources.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior