Senior Manufacturing Cybersecurity Engineer – Vulnerability Exposure Management

The role

Job Description

As a Senior Cybersecurity Vulnerability Engineer on GM’s Vulnerability Exposure Management team, you will serve as the senior technical contributor for Global Manufacturing and Operational Technology (OT) environments. You will lead the engineering and continuous improvement of processes, data, scoring, tooling, and stakeholder workflows used to manage vulnerabilities across GM manufacturing and industrial environments.

You will translate cyber intelligence and technical findings into plant-aware remediation priorities. Your decisions will account for exploitability, asset criticality, production impact, safety, uptime, solution complexity, maintenance windows, network location, existing mitigations, and business risk.

This role is ideal for a senior engineer who can work across cybersecurity operations and manufacturing disciplines, establish technical credibility with plant stakeholders, and move complex exposures from discovery through validated remediation.

All jobs

Senior Manufacturing Cybersecurity Engineer – Vulnerability Exposure Management

General Motors, Warren, Michigan

The role

Job Description

What you will do

Lead and support OT vulnerability and exposure management lifecycle for manufacturing IT/OT and Industrial Control Systems (ICS), protecting plant-floor operations while maintaining safe, reliable, and quality production.
Correlate findings from OT discovery platforms, vulnerability scanners, CMDB, network data, plant context, threat intelligence, and remediation systems.
Apply GM’s risk model and OT & MFG environmental variables to produce defensible ratings that reflect plant reality.
Evaluate how exploit impact, solution complexity, existing mitigations, segmentation, and operational constraints affect the final GM risk priority.
Triage exposures using industrial-specific context, CVSS, EPSS, and CISA Known Exploited Vulnerabilities (KEV), recognizing the operational constraints of legacy manufacturing hardware.
Map each vulnerability to the affected OT hardware or software, accountable owner, recommended solution, and target remediation date.
Act as the primary security liaison between manufacturing cybersecurity, plant IT team, and floor automation engineers to drive risk-informed mitigation plans.
Support rapid response to high-impact ICS vulnerabilities, actively exploited vulnerabilities, and emerging threats affecting GM manufacturing technologies.
Establish key performance indicators (KPIs) tracking exposure reduction and remediation velocity, translating technical plant-floor risk into executive-ready dashboards
Build and mature AI capabilities for ingestion & asset context enrichment, advanced attack path & risk prioritization, and remediation workflow automation.
Correlate scanner findings with asset, business, network, telemetry, identity, threat-intelligence, and SBOM context to improve prioritization accuracy and focus remediation on exposures most likely to create business risk.
Apply threat intelligence and exploitability analytics, including exposure context, attack-path factors, and evidence of exploitation, to move prioritization beyond severity-only scoring.
Provide technical leadership, mentoring, and consultative support to less experienced engineers and aligned remediation owners.

Your Skills & Abilities (Required Qualifications)

Bachelor’s degree in Cybersecurity, Computer Science, Engineering, Information Technology, or a related field, or equivalent practical experience.
Experience in cybersecurity engineering, vulnerability management, security operations, manufacturing IT/OT and Industrial Control Systems (ICS), infrastructure security, or related domains.
Working knowledge of PLCs, robots, HMIs, industrial automation, engineering workstations, and plant-floor systems.
Experience in large-scale enterprise automotive or manufacturing operations
Experience evaluating third-party OEM software, firmware updates, and coordinating securely with external field engineering vendors.
Knowledge of industrial networking and protocols, including IECN/PFCN environments, Industrial Ethernet, EtherNet/IP, DeviceNet, Profibus, or comparable technologies.
Experience assessing and prioritizing vulnerabilities where patching may be constrained by safety, production, availability, vendor support, or maintenance windows.
Understanding of CVSS, EPSS, CISA KEV, exploit maturity, active exploitation, attack paths, and risk-based prioritization beyond severity alone.
Experience with remediation governance, exception management, dashboards, metrics, and executive reporting.
Experience correlating vulnerability findings with business, asset, identity, telemetry, network, SBOM, and threat-intelligence context to support risk-based prioritization and exploitability-focused decision-making.
Strong understanding of remediation governance, exception management, dashboarding, metrics, and continuous improvement within a mature vulnerability management program.
Familiarity with enterprise and OT security platforms (e.g., Armis, Claroty, Tenable, Qualys, Dragos) and a strong understanding of network segmentation, VLANs, and port configurations in plant floors.
Experience in designing compensating controls and managing alternative mitigations when traditional, immediate software patching is impossible due to plant uptime constraints
Demonstrated ability to work independently, exercise strong judgment, and deliver results with minimal guidance.
Proven ability to solve complex, ambiguous problems using structured analysis and innovative approaches.
Strong communication and influence skills, including the ability to present recommendations supported by data and analysis.

What Will Give You A Competitive Edge (Preferred Qualifications)

Demonstrated ability to run an end-to-end vulnerability intelligence workflow for a high-profile CVE, from initial awareness through intelligence collection, environmental relevance scoping, contextual scoring, and tailored outputs for executive and technical stakeholders.
Ability to assess exploitability when public information is incomplete by reasoning through attack complexity, required privileges, user interaction, environmental preconditions, and the effectiveness of the control stack, then updating recommendations as PoCs and tooling emerge.
Proven ability to respond to high-impact 0-days in critical third-party products by rapidly validating noisy intelligence, scoping exposure, recommending interim mitigations, and structuring updates during the first 24 to 72 hours.
Ability to reconcile conflicting vulnerability data across vendors, scanners, commercial feeds, internal observations, document rationale, and establish a defensible environment-specific rating.
Experience defining and using leadership metrics and dashboards that combine scanner, CMDB, ticketing, and threat-intelligence data to track remediation urgency, business exposure, and time-to-remediate.
Knowledge of industrial cybersecurity frameworks, specifically ISA/IEC 62443 and NIST SP 800-82, to effectively evaluate and manage exposure.
Knowledge in leveraging the NIST Cybersecurity Framework (CSF 2.0) and CISA Cross-Sector Cybersecurity Performance Goals (CPGs) to govern, scorecard, and align technical vulnerabilities with enterprise risk metrics



GM does not provide immigration-related sponsorship for this role. Do not apply for this role if you will need GM immigration sponsorship now or in the future. This includes direct company sponsorship, entry of GM as the immigration employer of record on a government form, and any work authorization requiring a written submission or other immigration support from the company (e.g., H1-B, OPT, STEM OPT, CPT, TN, J-1, etc).

This role is categorized as hybrid.

This means the selected candidate is expected to report to a specific location at least 3 times a week {or other frequency dictated by their manager}.

Relocation benefits are available for candidates who qualify under company policy.

 About GM

Our vision is a world with Zero Crashes, Zero Emissions and Zero Congestion and we embrace the responsibility to lead the change that will make our world better, safer and more equitable for all.

Senior Manufacturing Cybersecurity Engineer – Vulnerability Exposure Management

The role

Senior Manufacturing Cybersecurity Engineer – Vulnerability Exposure Management

The role

What you will do

Pay and benefits

About General Motors

Similar jobs at other companies

OT Cybersecurity Engineer

Cybersecurity Architect - Remote

Vulnerability Management Engineering Lead

Information Vulnerability Management Engineer

Cybersecurity Engineer - Vulnerability Management

Tech Lead, Offensive Security

General Motors