Senior Cybersecurity Engineer - GRC Engineering & Technical Controls

Cybersecurity Jobs; Warren (MI); Hybrid; USD 150,000 - 230,000; Full time

Job summary

General Motors is seeking a highly technical GRC engineer to design and operate automated control frameworks across enterprise, cloud, and vehicle domains in a hybrid Warren, MI setting.

You will build data pipelines, develop AI-driven workflows, and translate regulatory standards into technical controls with near real-time verification and dashboards for executive insight.

Qualifications

• 7+ years of progress ive security or engineering experience in a highly technical environment.
• Hands-on programming with Python, Go, PowerShell or Bash to build integrations and APIs.
• Hands-on knowledge of AI agents, LLMs, and workflow orchestration for automating security tasks.
• Strong familiarity with Git-based workflows, CI/CD pipelines, and Policy-as-Code concepts.
• Experience with NIST SP 800-53, ISO 27001, SOC 2 and translating regulations into controls.
• Cloud infrastructure experience (AWS/Azure/GCP) and IAM, vulnerability management, and container deployments.
• Active professional certification (CISSP/CRISC/CISA/CGRC) or similar.

Responsibilities

• Architect, build, and maintain data pipelines connecting GRC platforms with cloud and on‑prem environments.
• Develop connectors and automation scripts to automate controls testing and evidence gathering.
• Standardize security policies into machine-readable formats and policy-as-code.
• Configure automated verification routines to monitor control effectiveness in near real-time.
• Develop AI-driven GRC workflows for risk assessments and evidence classification.
• Design AI agents and LLM-powered pipelines to generate compliance scorecards and remediation guidance.
• Interpret global and industry regulations and translate into actionable technical controls.
• Maintain Unified Controls Framework mapping regulatory obligations to engineering requirements.

Skills

Python

Go

PowerShell

Bash

AI agents

LLM APIs

Workflow orchestration

Git-based workflows

CI/CD pipelines

Policy-as-Code

Education

Bachelor’s degree in CS/SE/Cybersecurity

CISSP/CRISC/CISA/CGRC

Tools

AWS

Azure

GCP

IAM

CMDBs

Vulnerability scanners

Job description

Opportunity to scale enterprise cybersecurity governance with automation. In this hybrid role at General Motors in Warren, MI, you will design and operate technical control frameworks that strengthen risk management, regulatory compliance, and control assurance across enterprise, cloud, connected vehicle, and operational technology environments. You will help build GRC engineering capabilities that reduce manual effort and improve visibility with automated workflows and executive-ready telemetry.

What you’ll do

• Architect, build, and maintain data pipelines and middleware connecting GRC platforms with cloud environments, CMDBs, IAM tools, vulnerability scanners, and CI/CD pipelines.
• Develop custom connectors, automation scripts, and API-integrated workflows to automate controls testing and evidence gathering, reducing manual audit burdens.
• Standardize and codify security policies into machine-readable formats.
• Implement guardrails using cloud-native policy engines and automated infrastructure-as-code checking tools.
• Define, design, and configure automated verification routines to monitor control effectiveness in near real-time and flag configuration drift or compliance gaps.
• Develop and orchestrate AI-driven GRC workflows and agentic capabilities for automated risk assessments, control validation, and evidence classification.
• Design and integrate AI agents and LLM-powered pipelines with GRC platforms to streamline policy parsing, generate automated compliance scorecards, and provide intelligent remediation recommendations.
• Interpret global, regional, and industry-specific regulations (including privacy and automotive standards) and translate them into actionable, engineering-focused technical control standards.
• Maintain bidirectional traceability within a Unified Controls Framework (UCF) mapping regulatory obligations to engineering requirements, including NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, and vehicle cybersecurity regulations such as ISO/SAE 21434 and UN R155/R156.
• Conduct scheduled, event-driven, and automated technical audits to validate that control implementations meet regulatory and certification standards.
• Serve as the technical administrator and authority for the enterprise GRC / Integrated Risk Management (IRM) platform, including configuring advanced workflows, relational schemas, and API access.
• Establish and aggregate automated compliance telemetry (such as control coverage, deficiency aging, and real-time posture indicators) into executive-level dashboards.

What you’ll need

• Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Systems, or a related technical discipline (or equivalent practical experience).
• Minimum 7 years of progressive experience in a highly technical security environment, with strong focus on GRC engineering, security engineering, IT compliance, or DevSecOps.
• Hands‑on programming experience with Python, Go, PowerShell, or Bash to build integrations, parse data, and interface with APIs.
• Hands‑on experience or deep conceptual knowledge using AI agents, LLM APIs, and workflow orchestration frameworks to automate security and compliance tasks.
• Strong familiarity with Git‑based workflows, CI/CD pipelines, and infrastructure governance tools, including knowledge of Policy-as-Code concepts.
• Practical knowledge of major security frameworks (such as NIST SP 800‑53, ISO 27001, or SOC 2) and experience translating regulatory and certification requirements into technical controls.
• Practical knowledge of cloud infrastructure (AWS, Azure, or GCP), modern IAM models, vulnerability management architectures, and containerized deployments.
• At least one active, industry‑recognized professional certification in risk, audit, or security engineering (examples: CISSP, CRISC, CISA, or CGRC).

Technologies you may work with

• Python, Go, PowerShell, Bash
• AI agents, LLM APIs, workflow orchestration frameworks
• Git, CI/CD pipelines
• Cloud‑native policy engines, infrastructure‑as‑code checking tools
• AWS, Azure, GCP, IAM, containerized deployments
• GRC, Integrated Risk Management (IRM), CMDBs, vulnerability scanners
• Unified Controls Framework (UCF), NIST CSF, NIST SP 800‑53, ISO 27001, SOC 2
• ISO/SAE 21434, UN R155/R156

Certifications

• Required: Holds at least one active, industry‑recognized professional certification in risk, audit, or security engineering (e.g., CISSP, CRISC, CISA, or CGRC).
• Desired: Cloud or automation‑focused technical certifications (e.g., CCSP, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, or GIAC Cloud Security Automation).

Hybrid work details

• This role is categorized as hybrid. The selected candidate is expected to report to the specific location at least 3 times a week (or other frequency dictated by their manager).
• This job is not eligible for relocation benefits; relocation costs are the responsibility of the selected candidate.
• GM does not provide immigration‑related sponsorship for this role.

Benefits

Learn how GM supports a rewarding career that rewards you personally by visiting Total Rewards resources.