Senior Product Cybersecurity Engineer – Secure Product Architecture

Description

The company is the company, and this role sits in its Product Cybersecurity group. You will protect in-vehicle systems, their trust boundaries and access to vehicle functions.

You will be the security design owner for in-vehicle security, covering gateways, secure diagnostics, unlock and firewalls on current and future software-defined vehicle platforms.

You will be the go-to subject-matter expert for secure diagnostics and in-vehicle security, and you will create self-service references that let the wider team grow.

Responsibilities

• Own and develop the security design for secure diagnostics, secure unlock, in-vehicle private networks, gateways and firewalls.
• Turn threat assessments and architecture decisions into clear requirements that can be tested for vehicle systems, platforms and supplier components.
• Write and maintain policies that govern diagnostic access, communication paths, trust boundaries and traffic between in-vehicle domains.
• Build out and refine firewall and gateway policies as vehicle architectures, services and delivery needs change.
• Work with engineering, architecture, validation, service and supplier teams so controls and policies are implemented correctly.
• Lead and take part in security design, policy and implementation reviews with internal teams and suppliers.
• Find gaps, assess risk and push practical fixes for diagnostic access, secure unlock, gateway security and firewall policy enforcement.
• Keep requirements, design decisions and policy documents up to date with software-defined vehicle timelines and platform changes.

Requirements

• Have 6+ years in product, embedded, vehicle or automotive cybersecurity, with hands-on work on security design, requirements or policy.
• Have strong working knowledge of secure diagnostics, secure vehicle access, in-vehicle security, gateways and firewalls.
• Understand embedded security, including authentication, authorization, access control, secure communication and protection of sensitive vehicle functions.
• Have turned threat assessments and architecture decisions into technical security requirements and policies for engineering teams and suppliers.
• Have owned or maintained security policies and requirements across the development lifecycle.
• Have led security design and implementation reviews and aligned engineering, validation, service, architecture and supplier teams.
• Write clear technical documentation and explain complex security ideas to both security and non-security audiences.
• Hold a bachelor's or master's degree in computer science, computer engineering, electrical engineering or cybersecurity, or have equivalent practical experience.
• Preferred: experience with software-defined vehicle architectures and changing in-vehicle system designs.
• Preferred: experience working across supplier-delivered ECUs, gateways, firewall platforms, diagnostic systems and secure firmware.
• Preferred: experience defining or managing firewall policies, gateway security policies and communication security requirements.
• Preferred: prior embedded development, systems engineering or vehicle engineering experience.
• Preferred: prior work in automotive or another complex, deadline-driven, regulated field.
• Preferred: familiarity with threat assessment processes and turning threat outputs into requirements, implementation guidance and validation objectives.
• Preferred: experience balancing security rigor against platform capability, supplier constraints and vehicle program timing.
• Strong ownership: you push requirements, policy gaps and blocked items to closure instead of waiting on others.
• Pragmatic: you weigh security rigor against platform capability, supplier readiness and program timing.
• Sound judgment on risk, access control, trust boundaries and how to specify and implement security requirements.
• You share knowledge in packaged form so teams can scale without relying on one expert.
• You work with engineering and supplier teams to build secure capabilities early, not just review from the outside.
• You stay curious and adaptable as vehicle architectures, services and security expectations change.
• Immigration: GM does not provide immigration sponsorship for this role, now or in the future, including employer-of-record filings and any work authorization that needs written support from the company. Do not apply if you will need it.

Conditions

This is a hybrid role. You are expected to be on site at a specific location at least 3 days a week, or as your manager sets.

Relocation support is available for candidates who qualify under company policy.

GM is committed to a workplace free of unlawful discrimination and to equal employment opportunity.

Benefits

• Total Rewards programme covering well-being at work and at home, detailed on the company's Total Rewards resources.