Why GM Financial Cybersecurity?

Innovation isn’t just a talking point at GM Financial, it’s how we operate. By joining our team, you’ll work in a mission-focused environment with specialized teams, including Engineering, Threat Intelligence, Vulnerability Management, Incident Response, Firewall, Governance, Risk, Architecture and Offensive Security. These teams collaborate to identify, manage and respond to threats, all while driving innovation across the environment.

Cybersecurity is central to our strategic vision, so you’ll benefit from exceptional leadership visibility, with direct reporting lines to the CEO. This structure ensures your work is recognized and supported at the highest levels, while also enabling bold innovation and the adoption of cutting-edge technologies.

Shape the future of Cybersecurity at GM Financial, with the freedom to explore, the tools to build and the support to thrive.

This position will be posted until filled.

About the role

The Cybersecurity Analyst is responsible for coordinating the Cybersecurity Issues Management process and managing issues through the remediation lifecycle. This role facilitates issue intake activities, identifies and engages accountable owners, documents remediation plans, tracks progress against established milestones, and conducts ongoing follow-up with stakeholders to support timely remediation.

This role requires the ability to coordinate and prioritize multiple remediation efforts simultaneously, communicate effectively with stakeholders at all levels, and interpret technical issues and supporting evidence. The analyst leverages cybersecurity, vulnerability management, reporting, and workflow management tools to track progress, validate supporting evidence, and provide meaningful status reporting to stakeholders and leadership.

In this role you will:

• Manage cybersecurity issues throughout the remediation lifecycle, from intake and assignment through remediation validation and closure.

• Partner with issue owners and technical stakeholders to document remediation plans, target dates, key milestones, and track progress toward remediation objectives.

• Conduct ongoing follow-up activities to monitor remediation efforts, identify obstacles, drive accountability, and escalate risks, delays, and aging issues as appropriate.

• Research and interpret technical issues across a variety of domains, including network, Active Directory, web application, cloud, and infrastructure security, to effectively communicate risk and remediation plan with both technical and non-technical stakeholders.

• Coordinate regularly with Offensive Security and other Cybersecurity teams on finding statuses and validation requirements.

• Maintain accurate documentation, remediation records, status updates, and supporting evidence within designated workflow and tracking systems.

• Develop, maintain, and deliver reporting and metrics that provide leadership visibility into remediation progress, issue aging, trends, and overall cybersecurity risk posture.

• Identify opportunities to enhance issue management processes, reporting capabilities, and governance practices to improve efficiency, consistency, and stakeholder experience.

What makes you an ideal candidate?

• Experience in remediation management, issues management, vulnerability management, or similar role with direct exposure to tracking and remediating cybersecurity findings.

• Working familiarity with common security and reconnaissance tooling sufficient to interpret and validate output, as well as basic scripting ability (PowerShell or Bash preferred).

• Foundational understanding of cybersecurity principles, vulnerabilities, threats, and security controls.

• Ability to analyze information, identify trends, and evaluate potential business and risk impacts.

• Strong organizational skills with demonstrated ability to manage competing priorities and deadlines in a fast-paced environment.

• Effective written and verbal communication skills, including the ability to tailor communications for technical and non-technical audiences.

• Ability to build collaborative relationships and work effectively across cybersecurity, technology, and business teams.

• Knowledge of cybersecurity frameworks and industry standards such as NIST Cybersecurity Framework (CSF), NIST 800-53, ISO 27001, or similar frameworks.

• Understanding of common technology domains including networking, infrastructure, cloud, identity and access management, and application security.

• Strong analytical, problem-solving, and critical thinking skills.

• Experience interpreting technical documentation, issues, vulnerabilities, and remediation evidence.

• Experience with issue tracking, workflow management, reporting, or cybersecurity platforms is preferred.

• Demonstrated ability to independently investigate technical findings using open-source research to proactively close any gaps in technical understanding. 

Experience and Education

• Minimum of 1-5 years of experience in large and complex business environment with a successful track record working directly with senior level management preferred

• At least 1 year of experience in one or more of the following domains: Access Control, Telecom and Network Security, Cybersecurity Governance, Risk Management, Software Development Security, Cryptography, Security Architecture and Design, Operational Security, Business Continuity & Disaster Recovery, Legal Regulations, Investigations and Compliance, Physical (Environmental) Security, IT or Security Audit, IT or Security Compliance preferred

• Experience with UML Design Tools preferred

• Experience with alternate management methods using SSH, serial connections, and the command-line interface TMSH preferred

• Experience in documentation tools such as Visio and Microsoft Office products preferred

• Experience with Network and VLAN segmentation preferred

• Experience with technical writing preferred

• High School Diploma or equivalent required

• Bachelor’s Degree in related field or equivalent work experience strongly preferred

Licenses and Certifications

Information Security Certifications strongly preferred