Senior Cybersecurity Engineer - GRC Engineering & Technical Controls

Description

The company is in the middle of a large transformation in how it operates and in how it will shape future transportation. The Cybersecurity team sits within Global Enterprise IT and is looking for determined, inventive people to help the company move forward and reach its goals.

Responsibilities

• Manage enterprise cybersecurity risk, regulatory compliance and control assurance by combining governance knowledge with engineering work.
• Design, build and run technical control frameworks, and run risk and compliance assessments.
• Work with engineering teams to put security controls in place, check that they work and monitor them continuously across enterprise, cloud, connected vehicle and operational technology environments.
• Lead GRC engineering work that automates and scales governance, risk and compliance, including Continuous Control Monitoring (CCM), Compliance-as-Code, Policy-as-Code, automated evidence collection, control validation, workflow orchestration and AI-enabled governance.
• Turn regulatory, contractual, cybersecurity, privacy and vehicle cybersecurity requirements into technical controls and measurable assurance activities.
• Connect GRC platforms with security tools, cloud services and enterprise systems.
• Build and maintain data pipelines and middleware that link the GRC platform to cloud environments, CMDBs, IAM tools, vulnerability scanners and CI/CD pipelines.
• Write connectors, scripts and API-based workflows that automate control testing and evidence gathering, reducing manual audit work.
• Write security policies in machine-readable form, and add guardrails with cloud-native policy engines and automated infrastructure-as-code checks.
• Set up automated checks that monitor control effectiveness close to real time and flag configuration drift or compliance gaps right away.
• Build AI-driven GRC workflows and agent capabilities that automate complex risk assessments, control validation and evidence classification.
• Design AI agents and LLM-powered pipelines that connect to GRC platforms to parse policies, produce automated compliance scorecards and suggest remediation.
• Interpret global, regional and industry regulations, including privacy and automotive standards, and convert them into engineering-focused technical control standards.
• Keep two-way traceability in a Unified Controls Framework (UCF) that maps regulatory obligations to shared engineering requirements, such as NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, ISO/SAE 21434 and UN R155/R156.
• Run scheduled, event-driven and automated technical audits to confirm that controls meet strict regulatory and certification standards.
• Act as technical administrator and owner of the enterprise GRC / Integrated Risk Management (IRM) platform, configuring advanced workflows, relational schemas and API access.
• Build automated compliance telemetry, such as control coverage, deficiency aging and real-time posture indicators, and present it on executive dashboards.

Requirements

• Hold a bachelor's degree in Computer Science, Software Engineering, Cybersecurity, Information Systems or a related technical field, or have equivalent hands-on experience.
• Have at least 7 years of steadily growing experience in a highly technical security setting, focused on GRC engineering, security engineering, IT compliance or DevSecOps.
• Write code in Python, Go, PowerShell or Bash to build integrations, parse data and work with APIs.
• Have hands-on experience with, or solid conceptual knowledge of, AI agents, LLM APIs and workflow orchestration frameworks used to automate security and compliance tasks.
• Understand Git-based workflows, CI/CD pipelines and infrastructure governance tools, and know Policy-as-Code concepts.
• Have strong practical knowledge of major security frameworks such as NIST SP 800-53, ISO 27001 or SOC 2, and experience turning regulatory or certification requirements into technical controls.
• Have practical knowledge of cloud infrastructure on AWS, Azure or GCP, modern IAM models, vulnerability management architectures and containerized deployments.
• Preferred: Have direct experience building machine-readable compliance, automated controls testing, policy engine integration or continuous assurance programs.
• Preferred: Have designed, configured and maintained automated guardrails, automated evidence collection and configuration drift detection in production.
• Preferred: Have adapted unified control structures to map to complex automotive, vehicle safety or international privacy standards.
• Preferred: Have customized and deeply configured leading GRC/IRM platforms through custom APIs, database schemas and workflows.
• Required: Hold at least one active, industry-recognized certification in risk, audit or security engineering, such as CISSP, CRISC, CISA or CGRC.
• Desired: Hold cloud or automation-focused technical certifications, such as CCSP, AWS Certified Security, Specialty, Microsoft Certified: Azure Security Engineer Associate or GIAC Cloud Security Automation.

Conditions

The role is hybrid. You are expected to report to a specific location at least 3 times a week, or at a different frequency set by your manager.

The company does not provide immigration sponsorship for this role. Do not apply if you will now or in the future need company immigration sponsorship. This covers direct sponsorship, the company acting as immigration employer of record on a government form, and any work authorization that requires a written submission or other immigration support from the company, such as H-1B, OPT, STEM OPT, CPT, TN or J-1.

The role is not eligible for relocation benefits, so any relocation costs are the selected candidate's responsibility.

You may be asked to complete a role-related assessment and/or a pre-employment screening before you start.

The company is an equal opportunity employer and does not tolerate unlawful discrimination.

Benefits

• Well-being support at work and at home, starting from day one.
• Total Rewards resources that describe the rewards package and how it supports your career.