Cyber Threat and Risk Assessment Compliance Lead

Description

Hybrid:
This role is categorized as hybrid. This means the successful candidate is expected to report to Warren, MI three times per week, at minimum [or other frequency dictated by the business].
Relocation:
This job is not eligible for relocation benefits. Any relocation costs would be the responsibility of the selected candidate.

The Cyber Security TARA Compliance Lead is responsible for ensuring the quality and consistency of automotive cyber threat models and security control-to-validation test traceability to support cyber security type approval certifications.

Key Responsibilities:

• TARA governance: Conduct comprehensive attack path-based threat models for automotive systems per ISO/SAE 21434 requirements when required. Establish TARA practices, including security engineer TARA onboarding, periodic training, and cyber security type approval support.
• Standards Shaping: Actively participate in standards body cyber security technical committees (e.g., SAE and GRVA) and contribute to the development and evolution of standards that impact cyber security type approval requirements. Provide expert insights and recommendations that represent GM's position.
• Cross-functional Collaboration: Matrix across multiple GM engineering teams to ensure the integration of cybersecurity measures into all aspects of automotive system development.
• Traceability: Maintain and enforce processes fundamental to document traceability from TARA to requirements management to deviations to validation tests.
• Reporting and Documentation: Prepare, collate, and archive TARA reports. Document all processes and actions taken in compliance with ISO/SAE 21434 for audit and record-keeping purposes.

• Automotive Cybersecurity: Minimum 3-5 years of hands-on experience with ISO/SAE 21434 threat modeling and risk analysis for automotive systems
• Standards Knowledge: Demonstrated familiarity with UN R155, ISO/SAE 21434, and regulatory approval workflows
• Traceability & Process Control: Proven ability to manage TARA traceability across requirements, deviations, and validation test plans
• Documentation & Reporting: Experience producing audit-ready reports aligned to compliance frameworks and lifecycle governance
• Cross-functional Collaboration: Strong ability to matrix across multiple engineering domains (electrical, software, validation) to implement cybersecurity controls

• Standards Body Participation: Prior contribution to standards committees (e.g., SAE G-32, WP.29 GRVA) or regulatory working groups
• TARA Governance Frameworks: Experience onboarding cybersecurity engineers into TARA processes and conducting periodic threat modeling training
• Strategic Influence: Ability to shape internal cybersecurity policy based on external regulatory trends or Type Approval changes
• Tool Expertise: Familiarity with modeling platforms like itemis SECURE, VULTARA, Yocto TARA Builder, and process management systems (e.g., Stages)
• Education: Master's in cybersecurity, systems engineering, or a closely related field preferred