General Motors
Senior Cybersecurity Engineer – Vulnerability Exposure Management
Warren, Michigan, United States of America · Hybrid · Senior · Full-time · Posted Oct 29, 2026
- Education
- Bachelor’s degree in Cybersecurity, Computer Science, Engineering, Information Technology, or a related field, or equivalent practical experience.
- Visa sponsorship
- GM does not provide immigration-related sponsorship for this role, now or in the future; the posting includes work authorization requiring company immigration support among the examples.
About the job
Leads vulnerability exposure management for GM’s manufacturing and OT environments, prioritizing and coordinating plant-aware remediation while developing AI-supported risk and workflow capabilities.
What you'll do
- Manage the OT vulnerability lifecycle, correlate security and asset data, and set risk priorities that account for plant operations and safety.
- Coordinate mitigation and remediation with manufacturing cybersecurity, plant IT, and automation stakeholders; respond to high-impact vulnerabilities.
- Develop exposure-reduction metrics and dashboards, and build AI capabilities for asset-context enrichment, risk prioritization, and workflow automation.
What they ask for
- Bachelor’s degree in a related field or equivalent practical experience.
- Experience in cybersecurity, vulnerability management, security operations, manufacturing IT/OT, ICS, infrastructure security, or related domains.
- Working knowledge of industrial control and plant-floor systems, plus industrial networking and protocols.
- Experience prioritizing vulnerabilities under operational constraints and applying risk-based methods such as CVSS, EPSS, and CISA KEV.
Nice to have
- Knowledge of ISA/IEC 62443, NIST SP 800-82, NIST CSF 2.0, or CISA CPGs.
- Experience handling high-profile CVEs or 0-days, assessing exploitability, and building vulnerability metrics and dashboards.
Tools
PLCs, CVSS, EPSS, CISA Known Exploited Vulnerabilities (KEV), Armis, Claroty, Tenable, Qualys
AI focus
Build AI capabilities for ingestion and asset-context enrichment, attack-path and risk prioritization, and remediation workflow automation.
Model-written summary · the original posting is authoritative