Senior Cybersecurity Engineer, GRC Automation and Continuous Control Monitoring

Marathon Petroleum Corporation; Findlay (OH); Vor Ort; USD 120.000 - 160.000; Vollzeit

Zusammenfassung

Marathon Petroleum Corporation is seeking a Senior Cybersecurity Engineer for GRC Automation & CCM to advance automated control testing and evidence collection across cloud, on-premises, and OT environments.

You will design deterministic test logic and AI-backed workflows, collaborating with Cyber Fusion, Enterprise Architecture, and Cyber Engineering to strengthen regulatory compliance and risk visibility.

Qualifikationen

• Bachelor’s Degree in Information Technology, related field or equivalent experience.
• 5+ years of relevant experience required.
• Experience designing, implementing, and scaling GRC, CCM, or compliance automation solutions within a regulated environment.
• Experience in Python or comparable automation technologies with REST API integrations.
• Hands-on experience integrating security-control data sources into a GRC/CCM evidence pipeline across multiple domains.

Aufgaben

• Conducts detailed analyses on changes to cybersecurity solutions and its relationship to internal and external systems to assess control effectiveness and cybersecurity risk.
• Leverages cybersecurity assessments and compliance frameworks to ensure controls across security systems.
• Improves the efficiency and effectiveness of security solutions, governance processes, and automated controls.
• Analyzes processes and leads improvements, automation opportunities, or remediation activities.
• Responsible for development and submission of Standard Operating Procedures.
• Analyzes events and evaluates control performance and risk indicators through continuous monitoring.
• Investigates cyber incidents, assists in risk mitigation and remediation plans to ensure compliance.
• Leads implementation of global security initiatives, collects and reports security metrics and remediation efforts.
• Manages cybersecurity-related consulting and guidance to stakeholders.
• Translates security principles to configuration teams to incorporate requirements into build processes.
• Monitors emerging IT/OT, cybersecurity, automation, and AI technologies and their impact on security and risk.

Kenntnisse

GRC automation

Security risk assessment

Analytical thinking

Ausbildung

Bachelor’s Degree in Information Technology or related field

Tools

Python

REST APIs

Azure AI Foundry

GitHub

Open-source frameworks

Jobbeschreibung

An exciting career awaits youAt MPC, we’re committed to being a great place to work – one that welcomes new ideas, encourages diverse perspectives, develops our people, and fosters a collaborative team environment.

An exciting career awaits youAt MPC, we’re committed to being a great place to work – one that welcomes new ideas, encourages diverse perspectives, develops our people, and fosters a collaborative team environment.

Position Summary

The GRC Automation & Continuous Controls Monitoring (CCM) Senior Cybersecurity Engineer is a strategic and technical role, responsible or helping turn GRC into a trust engine for the business: reducing audit friction, improving business risk exposure visibility, accelerating evidence readiness, and enabling stronger operational confidence. The role serves as the technical focal for GRC automation, developing automated evidence collection, control testing, risk intelligence, and AI-enabled governance capabilities across cloud, on-premises, identity, operational technology (OT), and security platforms. The role collaborates closely with Cyber Fusion, Enterprise Architecture, and Cyber Engineering, to design and build deterministic control-testing logic where deterministic approaches are enough; and AI agents and LLM-backed workflows where reasoning, summarization, or judgment is required, such as evidence-to-control mapping, attestation drafting, drift detection, and audit-package assembly. This position belongs to a family of jobs with increasing responsibility, competency, and skill level. Actual position title and pay grade will be based on the selected candidate’s experience and qualifications.

Key Responsibilities

• Conducts detailed analyses on changes to cybersecurity solutions and its relationship to internal and external systems to assess control effectiveness and cybersecurity risk. Resolves complex multi-functional technical issues.
• Leverages cybersecurity assessments, standards, control testing methodologies, and compliance frameworks to ensure compliance across security systems.
• Improves the efficiency and effectiveness of Security solutions, governance processes, automated controls, and monitoring capabilities.
• Analyzes existing processes and procedures and leads efforts for implementing improvements, automation opportunities, or remediation activities.
• Responsible for development and submission of Standard Operating Procedures.
• Analyzes business impacting events, performs initial investigation, and evaluates control performance, exceptions, and risk indicators through continuous monitoring activities.
• Investigates and analyzes the nature and scope of cyber incidents, control failures, and compliance exceptions. Assists in the development of risk mitigation and remediation plans to ensure regulatory and internal compliance. compliance.
• Leads implementation of global security initiatives, policies, compliance requirements, and continuous control monitoring practices. Collects, validates, and reports security metrics, control performance results, and remediation efforts associated with them.
• Manages cyber security-related consulting, guidance, and support to customers and stakeholders.
• Translates security principles to assist configuration teams with incorporating security and compliance requirements into build and configuration processes.
• Monitors emerging IT/OT, cybersecurity, automation, and artificial intelligence technologies as well as their impact on the security, risk, and compliance landscape.

Education and Experience

• Bachelor’s Degree in Information Technology, related field or equivalent experience.
• 5+ years of relevant experience required
• Experience designing, implementing, and scaling GRC, CCM, or compliance automation solutions within a regulated environment required
• Experience in Python or comparable automation technologies, proficient in developing, integrating, and supporting automated workflows and REST API-based data integrations across multiple enterprise systems required.
• Hands-on experience integrating security-control data sources into a GRC / CCM evidence pipeline for continuous control testing required. This includes normalizing API, telemetry, configuration, vulnerability, identity, ticketing, and assessment data into control-level evidence, exception logic, ownership, frequency, and audit-ready records across at least three domains such as CNAPP / CSPM, SIEM / security data lake / XDR, CTEM / VM / ASPM, DSPM, ITSM, IAM, GRC / CCM, or AI/agent governance required.
• Experience building LLM-backed agentic workflows on Azure AI Foundry, GitHub, or open-source frameworks preferred.
• Familiarity