Manager - Product Cyber Security Compliance

General Motors LLC; United States; Hybrid; USD 140,000 - 200,000; Full time

Job summary

General Motors is seeking a Manager, Cybersecurity Engineer to lead the GRC program for vehicle product cybersecurity. You will own the compliance posture across programs, drive threat modeling, and shape policies and standards to address evolving regulations.

This role requires coordinating global audits, leading a high-performance team, and collaborating with government authorities and internal stakeholder groups.

Qualifications

• Bachelor's or Master's degree in Cybersecurity, Computer Science, Engineering, or a related field.
• Minimum 10 years of experience in cybersecurity, with focus on GRC, regulatory compliance, or product/automotive cybersecurity.
• Demonstrated experience leading teams, including people management and talent development.
• Deep knowledge of UNR155, UNECE WP.29, NIST CSF and global automotive cybersecurity regulations.
• Experience in Vehicle Type Approval processes and/or CSMS audits with government/regulatory bodies.
• Hands-on experience with Threat Analysis and Risk Assessment (TARA).
• Strong expertise in ISO/SAE 21434, ISO 27001, NIST CSF, NIST SP 800-53.
• Experience developing or maintaining cybersecurity policies and standards.

Responsibilities

• Own and maintain GM's product cybersecurity controls framework across vehicle programs and markets.
• Lead TARA activities ensuring threat models are current and integrated into product lifecycle.
• Provide requirements for cybersecurity policies and standards; drive approvals and cross-functional alignment.
• Monitor global automotive cybersecurity regulations and translate changes into actionable obligations.
• Oversee UNR155 compliance, Vehicle Type Approval, and CSMS audits with government/regulatory bodies.
• Manage audit readiness, evidence prep, submission coordination, and post-audit remediation.
• Build relationships with government authorities, type approval bodies, and technical services.
• Identify control gaps and drive cross-functional remediation with engineering teams.
• Establish tracking for control gap closure and report status to leadership.
• Conduct root cause analyses and implement durable remediation strategies.

Skills

GRC leadership

Threat Modeling

Regulatory compliance

Cybersecurity policy

UNR155

UNECE WP.29

ISO/SAE 21434

Audits & evidence

Cross-functional leadership

Education

Bachelor's in Cybersecurity

Master's in a related field

Tools

GRC tools

Job description

About the Role

The Manager, Cybersecurity Engineer is a senior people leadership role within GM Cybersecurity, and part of the Cybersecurity Governance, Risk & Compliance team. This role owns GM's vehicle product cybersecurity compliance posture — including conducting threat analysis and risk assessment, providing requirements to GM’s Cybersecurity policy and underlying standards, ensuring global regulatory compliance, and orchestrating government-facing audits — while driving control gap remediation across vehicle engineering and product teams. As the regulatory landscape continues to evolve, this role is also responsible for incorporating emerging vehicle theft‑related and compliance requirements into GM's product cybersecurity controls framework.

Key Responsibilities

• Product Cybersecurity Compliance Own and maintain GM's product cybersecurity controls framework, ensuring coverage across all applicable vehicle programs, markets, and regulatory requirements.
• Lead and oversee Threat Analysis and Risk Assessment (TARA) activities for vehicle product systems, ensuring threat models are current, comprehensive, and integrated into the vehicle development lifecycle.
• Provide requirements for and input to product cybersecurity policies and standards aligned to evolving threats, regulatory mandates, and industry best practices; drive necessary approvals and ensure cross-functional integration.
• Monitor and interpret global automotive cybersecurity regulations and standards (e.g., ISO/SAE 21434, ISO 24089, UNECE WP.29 frameworks), translating changes into actionable compliance obligations for internal teams.
• Track emerging vehicle theft‑related cybersecurity compliance requirements and drive necessary programmatic responses across applicable vehicle programs and markets.
• UNR155 & Vehicle Type Approval: Own GM's compliance program for United Nations Regulation No. 155 (UNR155) — the global standard for automotive cybersecurity — and serve as the lead orchestrator for Vehicle Type Approval (VTA) and Cybersecurity Management System (CSMS) audits with government agencies and technical services globally.
• Manage all aspects of audit readiness, evidence preparation, submission coordination, and post‑audit remediation across multiple regulatory jurisdictions.
• Build and maintain productive relationships with government authorities, type approval bodies, and technical service organizations (e.g., IDIADA, etc.) across international markets.
• Ensure audit artifacts, compliance documentation, and CSMS evidence packages are current, complete, and audit‑ready at all times.
• Control Gap Identification & Remediation Lead the identification, assessment, and prioritization of cybersecurity control gaps across vehicle product systems, aligned to UNR155, ISO/SAE 21434, and other applicable frameworks.
• Drive cross‑functional remediation efforts, partnering with Vehicle Cybersecurity Engineering and other engineering teams to develop and execute corrective action plans.
• Establish and maintain tracking mechanisms for control gap closure, reporting status to senior leadership on a regular cadence.
• Conduct or oversee root cause analyses of identified control deficiencies and systemic risk trends, ensuring durable remediation strategies are implemented.

Cross-Functional Partnership

• Partner closely with the Vehicle Cybersecurity Engineering team and other engineering organizations to align compliance requirements to design and development processes throughout the vehicle lifecycle.
• Collaborate with Legal, Government Affairs, Program Management, and Supplier teams to ensure a coordinated approach to regulatory compliance.
• Provide cybersecurity GRC expertise and compliance guidance to internal stakeholders, translating complex regulatory requirements into clear, actionable direction for engineering and program teams.
• Represent GM's product cybersecurity GRC program in external‑facing engagements, including regulatory submissions, audits, and industry working groups.

People Leadership & Team Management

• Lead, develop, and mentor a team of cybersecurity GRC professionals, fostering a high‑performance culture grounded in accountability, collaboration, and continuous growth.
• Set clear objectives, establish Key Performance Indicators (KPIs), and own delivery of team results aligned to organizational and GM strategic priorities.
• Manage workforce planning, talent development, and performance management for all direct reports.
• Build a team with the optimal mix of expertise and experience, supporting hiring and onboarding activities as needed.
• Champion GM's behaviors and values, fostering an inclusive and psychologically safe team environment.

Your Skills & Abilities (Required Qualifications)

• Bachelor's or Master's degree in Cybersecurity, Computer Science, Engineering, or a related field
• Minimum 10 years of experience in cybersecurity, with a focus on GRC, regulatory compliance, or product/automotive cybersecurity
• Demonstrated experience leading teams, including people management, performance management, and talent development
• Deep knowledge of UNR155, UNECE WP.29, NIST CSF and global automotive cybersecurity regulatory frameworks
• Experience orchestrating or directly participating in Vehicle Type Approval processes and/or CSMS audits with government or regulatory bodies
• Hands‑on experience with Threat Analysis and Risk Assessment (TARA) methodologies and integration into the vehicle development lifecycle
• Strong expertise in cybersecurity controls frameworks (e.g., ISO/SAE 21434, ISO 27001, NIST CSF, NIST SP 800‑53)
• Experience developing or maintaining cybersecurity policies and standards aligned to regulatory and industry requirements
• Proven ability to identify control gaps, develop remediation strategies, and drive closure across cross‑functional engineering teams
• Experience managing complex, multi‑stakeholder programs across global, geographically distributed organizations
• Strong analytical, problem‑solving, and critical thinking skills, with ability to assess systemic issues and translate findings into executive‑ready reports
• Excellent communication, presentation, and interpersonal skills — able to engage effectively with technical teams, senior leadership, and government representatives
• Ability to manage multiple high‑complexity programs concurrently and prioritize effectively under shifting regulatory demands
• Strong work ethic, attention to detail, and commitment to excellence

What Will Give You A Competitive Edge (Preferred Qualifications)

• (Not mandatory, but would give candidates a competitive edge) Relevant professional certifications (e.g., CGRC, CRISC, CISA, CISSP, ISO/SAE 21434 Lead Auditor, PMP)
• Familiarity with vehicle theft‑related cybersecurity regulations and compliance obligations (e.g., NHTSA guidance, regional anti‑theft mandates)
• Experience with GRC software tools and platforms (e.g., Archer, ServiceNow, IBM OpenPages)
• Working knowledge of automotive embedded systems, vehicle Electronic Control Unit (ECU) architecture, or connected vehicle technologies
• Experience engaging with technical service organizations (e.g., IDIADA, etc.) in the context of type approval
• Familiarity with automotive supply chain cybersecurity requirements and partner/supplier compliance programs
• Data analytics, dashboard development, or GRC platform reporting experience
• Prior experience in a global automotive Original Equipment Manufacturer (OEM), Tier 1 supplier, or government agency environment
• Experience with enterprise risk frameworks (e.g., COSO, FAIR, ERM) in a product cybersecurity context

GM does not provide immigration‑related sponsorship for this role. Do not apply for this role if you will need GM immigration sponsorship now or in the future. This includes direct company sponsorship, entry of GM as the immigration employer of record on a government form, and any work authorization requiring a written submission or other immigration support from the company (e.g., H1‑B, OPT, STEM OPT, CPT, TN, J‑1, etc).

This role is categorized as hybrid. This means the selected candidate is expected to report to a specific location at least 3 times a week {or other frequency dictated by their manager}. This job may be eligible for relocation benefits.

About GM

Our vision is a world with Zero Crashes, Zero Emissions and Zero Congestion and we embrace the responsibility to lead the change that will make our world better, safer and more equitable for all.

Why Join Us

We believe we all must make a choice every day – individually and collaboratively – to drive meaningful change through our words, our deeds and our culture. Every day, we want every employee to feel they belong to one General Motors team.

Benefits Overview

From day one, we’re looking out for your well‑being–at work and at home–so you can focus on realizing your ambitions. Learn how GM supports a rewarding career that rewards you personally by visiting Total Rewards resources.

Non-Discrimination and Equal Employment Opportunities (U.S.)

General Motors is committed to being a workplace that is not only free of unlawful discrimination, but one that genuinely fosters inclusion and belonging. We strongly believe that providing an inclusive workplace creates an environment in which our employees can thrive and develop better products for our customers. All employment decisions are made on a non‑discriminatory basis without regard to sex, race, color, national origin, citizenship status, religion, age, disability, pregnancy or maternity status, sexual orientation, gender identity, status as a veteran or protected veteran, or any other similarly protected status in accordance with federal, state and local laws.

Accommodations

General Motors offers opportunities to all job seekers including individuals with disabilities. If you need a reasonable accommodation to assist with your job search or application for employment, email us or call us at 1‑800‑865‑7580. In your email, please include a description of the specific accommodation you are requesting as well as the job title and requisition number of the position for which you are applying.

We are leading the change to make our world better, safer and more equitable for all through our actions and how we behave. Learn more about: Our Company Our Culture How we hire Our diverse team of employees bring their collective passion for engineering, technology and design to deliver on our vision of a world with Zero Crashes, Zero Emissions and Zero Congestion. We are looking for adventure‑seekers and imaginative thought leaders to help us transform mobility. Explore our global locations We are determined to lead change for the world through technology, ingenuity and harnessing the creativity of our diverse team. Join us to help lead the change that will make our world better, safer and more equitable for all by becoming a member of GM’s Talent Community (beamery.com). As a part of our Talent Community, you will receive updates about GM, open roles, career insights and more.