IT Senior Security Engineer - Governance, Risk, and Compliance

Delta Air Lines, Inc.; Atlanta (GA); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Delta Air Lines, Inc. seeks a Sr. Security Engineer - Governance, Risk, and Compliance who blends strategic governance with hands-on automation.

You will shape Delta's information security standards, map controls to regulatory frameworks, and build automation that measures control effectiveness and KPI data in real time. You will partner with Cloud, PKI, Network, and IoT security teams to scale secure solutions enterprise-wide.

Qualifications

• Strategic governance leadership in information security with hands-on automation experience.
• Experience aligning security programs with regulatory frameworks and business goals.
• Strong Python scripting and IaC infrastructure automation.
• Ability to communicate risk and security metrics to executives and engineers.

Responsibilities

• Provide Policy and Standards leadership with Delta's information security policy, standards, and procedures.
• Own mappings to regulatory frameworks (NIST, PCI DSS, ISO 27001) and ensure traceability in the GRC platform (RSA Archer).
• Design, build, and deploy automated security control tests and metric collectors using Python and IaC; publish results to dashboards.
• Develop KPIs and KRIs end-to-end, from metric selection to real-time visualization for leadership.
• Establish reusable engineering patterns and tooling to scale metric automation across teams.
• Lead production changes through RFC processes and coordinate deployments with zero-incident execution.
• Advance security guidance and documentation across internal platforms with clear, plain language.
• Improve security posture through process automation and risk-based insights for leadership.
• Foster a security-driven culture and communicate the value of information security to stakeholders.
• Tackle complex security challenges at enterprise scale and provide options for risk reduction.

Skills

Governance leadership

Automation engineering

Security metrics

Stakeholder communication

Tools

RSA Archer

Python

Infrastructure as Code

Job description

At Delta, we connect people and cultures, power extraordinary experiences, and shape the future of travel. Here, you'll work on complex challenges on a global scale, using augmented intelligence to build emerging technologies, amplify human potential and continuously grow the skills that keep you at the forefront of what's next.

The Sr. Security Engineer - Governance, Risk, and Compliance is a rare hybrid: a strategic governance leader and a hands-on automation engineer. This person excels at both the strategy and execution needed to ensure the Information Security Governance team drives organizational behavior change, fosters a security-first culture, and reduces risk through well-defined policies, standards, and measurable security outcomes.

This is as much a builder's role as it is a governance role. You will define Delta's Information Security Standards and maintain mappings to regulatory and industry frameworks. You will also design, build, and deploy automation solutions that collect, calculate, and visualize security control effectiveness and KPI data, providing leadership with real-time insight into security posture and risk.

You will create new processes, tooling, and scalable solutions within a team transforming how Information Security supports the business and protects the information entrusted to us by customers, employees, and partners. Working closely with engineers, architects, tool owners, and security leaders across domains including Cloud Security, PKI, Network Security, and IoT/OT Security, you will drive alignment, enable others to build secure solutions, and solve complex security challenges at enterprise scale.

• Provide Policy and Standards subject-matter leadership through the development and maintenance of Delta's Information Security Policy, Standards, and procedures - updating them at least annually, ensuring alignment with applicable frameworks and regulations, and ensuring they are clear and understandable at all levels of the organization, from technical teams to frontline personnel.
• Own and maintain the mapping of Information Security Standards to authoritative regulatory frameworks (e.g., NIST 800-53, NIST 800-171, PCI DSS, SOX, ISO 27001) and sustain the full compliance-traceability chain - from authoritative source through standard, control, evidence, findings, and exceptions - within Delta's GRC platform (RSA Archer), including the governed, auditable standards-change approval workflow and Domain Owner review model.
• Design, build, and deploy automated security control tests and metric collectors - writing production code (Python, Infrastructure-as-Code) that connects to security tools' APIs, calculates coverage, risk-reduction, and process/governance metrics, and publishes results to the GRC platform and to Information Security dashboards for leadership.
• Develop and own Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) end-to-end - from identifying the right metric with tool owners, through calculation logic, to real-time visualization - to measure the effectiveness of Delta's Information Security program.
• Establish reusable engineering patterns, templates, and developer tooling (including AI-assisted development agents, automation scripts, and documentation standards) that enable tool owners and other engineers to contribute to metric automation quickly and consistently, scaling delivery beyond a single engineer.
• Shepherd changes to production through the enterprise change-management process - authoring Request for Change (RFC) documents, answering Change Advisory Board (ECAB) questions, and coordinating deployments with zero-incident execution.
• Advance security documentation and guidance - including publishing standards, supplemental guidance, and emerging-technology mandates (such as AI security mandates and cloud/SaaS security requirements) - on Delta's internal documentation platforms in clear, plain language.
• Improve Delta's security positioning through process improvement, policy, automation, and the continuous evolution of capabilities; identify automation opportunities and provide innovative, risk-based insights to inform Information Security leadership.
• Help develop a strong security-driven culture where security is part of every employee's day-to-day operations and attitudes, and communicate the value of Information Security to key stakeholders.
• Tackle "big" problems, provide options, and drive resolution.