Lead Auditor - Cybersecurity Assurance

Lead Auditor, Cybersecurity Assurance

General Motors Audit Services (GMAS) is seeking a Lead Auditor, Cybersecurity Assurance to lead risk-based cybersecurity assurance engagements across a complex global environment. This role is responsible for planning, executing, and reporting on reviews that evaluate the design and operating effectiveness of cybersecurity and technology controls.

This individual will work across a broad range of domains, including enterprise technology, cloud, identity and access management, application security, incident response, and infrastructure security. The role also partners closely with business and technology leaders to communicate risk, drive practical remediation, and help strengthen GM's overall cybersecurity posture.

This is a strong opportunity for a cybersecurity audit professional who wants exposure to a large-scale, highly connected environment and enjoys combining technical depth, sound judgment, and leadership.

What You'll Do

• Lead end-to-end cybersecurity assurance engagements, including scoping, planning, fieldwork, issue development, and reporting.
• Evaluate the effectiveness of cybersecurity controls across key risk areas such as identity and access management, logging and monitoring, vulnerability management, incident response, backup and recovery, and security configuration.
• Apply a risk-based perspective to identify control gaps, emerging threats, and opportunities to improve cybersecurity resilience.
• Review testing workpapers and evidence to ensure conclusions are clear, supportable, and aligned to audit standards and methodology.
• Develop concise, executive-ready reports that clearly articulate risk, root cause, and practical corrective actions.
• Present results and themes to business and technology leaders, including senior management, and align remediation priorities.
• Coach and support team members throughout the audit lifecycle, including testing strategy, issue validation, and stakeholder communication.
• Build strong working relationships with stakeholders across cybersecurity, IT, privacy, compliance, and other relevant functions.
• Contribute to continuous improvement of the cybersecurity assurance program, including risk assessment, planning, and reusable testing approaches.
• Monitor remediation activity and validate that agreed actions appropriately address identified risk.
• Maintain a strong understanding of GM operations and technology landscape to anticipate emerging cyber risks and adapt assurance coverage accordingly.

Your Skills & Abilities (Required Qualifications)

• Bachelor's degree in Information Systems, Computer Science, Cybersecurity, or a related field (or equivalent related experience).
• 5+ years of experience in IT audit, cybersecurity, risk management, or technology assurance, including leading engagements and guiding teams through planning, testing, and reporting.
• Strong understanding of cybersecurity and technology risk, including evaluating confidentiality, integrity, and availability (CIA) across complex, interconnected systems.
• Strong knowledge of internal controls and risk frameworks such as NIST CSF, NIST 800-53, COBIT, ISO 27001, or similar frameworks, with the ability to translate requirements into practical test procedures
• Understanding of technology infrastructure and operations (e.g., endpoint/server hardening, monitoring, backup/recovery, and change/release practices) and how to evaluate control effectiveness.
• Experience assessing controls across core cybersecurity domains such as Identity & Access Management (IAM), privileged access, logging and monitoring, incident response, backup and recovery, vulnerability management, and security configuration controls.
• Strong written and verbal communication skills, including the ability to communicate technical risk clearly to non-technical stakeholders and senior leaders
• Demonstrated ability to work independently, exercise sound judgment, manage multiple priorities, and deliver results in a fast-paced environment.

What Will Give You A Competitive Edge (Preferred Qualifications)

• Graduate degree in Information Technology, Cybersecurity, or a related field.
• Professional certification(s) such as CISA, CISSP, CISM, CRISC, CEH, or other relevant security or technology certifications.
• Big 4 public accounting firm experience and/or a recognized internal audit/assurance program.
• Working knowledge of networking and security technologies (e.g., routing/switching, ACLs, IDS/IPS, firewalls, and secure remote access).
• Working knowledge of application security concepts, including secure development practices, vulnerability management, and common testing approaches.
• Familiarity with operating system platforms (e.g., UNIX/Linux, Windows) and security best practices for each.
• Hands-on experience with scripting, automation, or data analysis to enable more efficient testing (e.g., PowerShell, Python, SQL)
• Strong interpersonal skills and demonstrated people leadership (e.g., coaching, delegation, conflict resolution, and stakeholder management).
• Strong analytical, problem-solving, and professional judgment skills, with the ability to prioritize and make risk-based decisions.

Location: Hybrid. This role is categorized as hybrid. This means the successful candidate is expected to report to the Global HQ Detroit, MI three times per week, at minimum [or other frequency dictated by the business] Relocation: This role is NOT eligible for relocation benefits. GM DOES NOT PROVIDE IMMIGRATION-RELATED SPONSORSHIP FOR THIS ROLE. DO NOT APPLY FOR THIS ROLE IF YOU WILL NEED GM IMMIGRATION SPONSORSHIP NOW OR IN THE FUTURE. THIS INCLUDES DIRECT COMPANY SPONSORSHIP, ENTRY OF GM AS THE IMMIGRATION EMPLOYER OF RECORD ON A GOVERNMENT FORM, AND ANY WORK AUTHORIZATION REQUIRING A WRITTEN SUBMISSION OR OTHER IMMIGRATION SUPPORT FROM THE COMPANY (e.g., H-1B, OPT, STEM OPT, CPT, TN, J-1, etc.)