Senior Cybersecurity Engineer, GRC Automation and Continuous Control Monitoring

We need to output HTML fragment with sections: h3 for headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content. We must not repeat job title as heading. No Job ID etc. Remove boilerplate. Preserve all substantive info. We need to parse the posting. Key parts: - Opening: "An exciting career awaits you At MPC, we’re committed to being a great place to work – one that welcomes new ideas, encourages diverse perspectives, develops our people, and fosters a collaborative team environment." This is about the role/company. Could be "About the role" or maybe "About MPC". Use heading "About the role". Use

. - Position Summary paragraph: "The GRC Automation & Continuous Controls Monitoring (CCM) Senior Cybersecurity Engineer is a strategic and technical role, responsible or helping turn GRC into a trust engine for the business: reducing audit friction, improving business risk exposure visibility, accelerating evidence readiness, and enabling stronger operational confidence. The role serves as the technical focal for GRC automation, developing automated evidence collection, control testing, risk intelligence, and AI-enabled governance capabilities across cloud, on-premises, identity, operational technology (OT), and security platforms. The role collaborates closely with Cyber Fusion, Enterprise Architecture, and Cyber Engineering, to design and build deterministic control-testing logic where deterministic approaches are enough; and AI agents and LLM-backed workflows where reasoning, summarization, or judgment is required, such as evidence-to-control mapping, attestation drafting, drift detection, and audit-package assembly. This position belongs to a family of jobs with increasing responsibility, competency, and skill level. Actual position title and pay grade will be based on the selected candidate’s experience and qualifications." We can include this under "About the role" or maybe separate "Position Summary". But headings limited to given list. Could put under "About the role". Or we could have "Responsibilities" for key responsibilities. We'll need to decide. Key Responsibilities list: many bullet-like sentences separated by periods. We need to convert to

• . We'll extract each responsibility sentence. List them: - Conducts detailed analyses on changes to cybersecurity solutions and its relationship to internal and external systems to assess control effectiveness and cybersecurity risk. - Resolves complex multi-functional technical issues. - Leverages cybersecurity assessments, standards, control testing methodologies, and compliance frameworks to ensure compliance across security systems. - Improves the efficiency and effectiveness of Security solutions, governance processes, automated controls, and monitoring capabilities. - Analyzes existing processes and procedures and leads efforts for implementing improvements, automation opportunities, or remediation activities. - Responsible for development and submission of Standard Operating Procedures. - Analyzes business impacting events, performs initial investigation, and evaluates control performance, exceptions, and risk indicators through continuous monitoring activities. - Investigates and analyzes the nature and scope of cyber incidents, control failures, and compliance exceptions. Assists in the development of risk mitigation and remediation plans to ensure regulatory and internal compliance. - Leads implementation of global security initiatives, policies, compliance requirements, and continuous control monitoring practices. - Collects, validates, and reports security metrics, control performance results, and remediation efforts associated with them. - Manages cyber security-related consulting, guidance, and support to customers and stakeholders. - Translates security principles to assist configuration teams with incorporating security and compliance requirements into build and configuration processes. - Monitors emerging IT/OT, cybersecurity, automation, and artificial intelligence technologies as well as their impact on the security, risk, and compliance landscape. We'll put these under

  Responsibilities

  with
  . Education and Experience section: includes bullet points. - Bachelor’s Degree in Information Technology, related field or equivalent experience. - 5+ years of relevant experience required - Experience designing, implementing, and scaling GRC, CCM, or compliance automation solutions within a regulated environment required - Experience in Python or comparable automation technologies, proficient in developing, integrating, and supporting automated workflows and REST API-based data integrations across multiple enterprise systems required. - Hands-on experience integrating security-control data sources into a GRC / CCM evidence pipeline for continuous control testing required. This includes normalizing API, telemetry, configuration, vulnerability, identity, ticketing, and assessment data into control-level evidence, exception logic, ownership, frequency, and audit-ready records across at least three domains such as CNAPP / CSPM, SIEM / security data lake / XDR, CTEM / VM / ASPM, DSPM, ITSM, IAM, GRC / CCM, or AI/agent governance required. - Experience building LLM-backed agentic workflows on Azure AI Foundry, GitHub, or open-source frameworks preferred. - Familiarity with NIST AI RMF, the OWASP LLM Top 10, or comparable AI risk frameworks preferred. We could put these under "Requirements" or "Qualifications". The list includes both education and experience. Could split: "Education" maybe but not in allowed headings. Use "Requirements" for mandatory items, "Qualifications" for preferred? But we have both required and preferred. Could combine under "Requirements". Or we could have "Education and Experience" as a heading but not allowed. So we need to map to allowed headings: maybe "Qualifications" for education/experience, "Skills" for skills list. The skills list is a big list of skill names with descriptions. We'll put those under

  Skills

  with
  . Benefits: At the end: "Marathon Petroleum offers a total rewards program which includes, but is not limited to, access to health, vision, and dental insurance, paid time off, 401k matching program, paid parental leave, and educational reimbursement. Detailed benefit information is available at https://mympcbenefits.com.The hired candidate will also be eligible for a discretionary company-sponsored annual bonus program." We have specific benefits: health, vision, dental insurance; paid time off; 401k matching; paid parental leave; educational reimbursement; discretionary annual bonus. So we can create Benefits section with
  . Pay: Not specified; there is "Actual position title and pay grade will be based on the selected candidate’s experience and qualifications." That's not a specific pay figure. According to rules, we should NOT create Pay section unless posting actually states them. It does not state a specific pay or range. So we should omit Pay section. Schedule: Not specified; we have "Employee Group: Full time Employee Subgroup: Regular". That indicates full-time regular. Could we create Schedule section? The posting states full-time. That's a schedule info. The rule: include a section ONLY when posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g., "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. It does state full-time regular. So we can include Schedule section with that info. But we need to see if "Schedule" is appropriate heading. We'll include

  Schedule

  with

  Full-time regular position.

  Location: Not in allowed headings; we could fold into About the role paragraph or maybe a separate paragraph. The instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

  or drop it. Location is minor metadata; we can include in a short

  after About the role. We also have "Location: San Antonio, Texas Additional locations: Findlay, Ohio, Houston, Texas". We'll include that. We must remove boilerplate: EEO, equal opportunity, scam warning, application instructions, etc. Also remove navigation/cookie etc. Not present. We must preserve all substantive information. Ensure we don't lose any. Now craft HTML. Structure:

  About the role

  An exciting career awaits you At MPC, we’re committed to being a great place to work – one that welcomes new ideas, encourages diverse perspectives, develops our people, and fosters a collaborative team environment.

  The GRC Automation & Continuous Controls Monitoring (CCM) Senior Cybersecurity Engineer is a strategic and technical role, responsible or helping turn GRC into a trust engine for the business: reducing audit friction, improving business risk exposure visibility, accelerating evidence readiness, and enabling stronger operational confidence. The role serves as the technical focal for GRC automation, developing automated evidence collection, control testing, risk intelligence, and AI-enabled governance capabilities across cloud, on-premises, identity, operational technology (OT), and security platforms. The role collaborates closely with Cyber Fusion, Enterprise Architecture, and Cyber Engineering, to design and build deterministic control-testing logic where deterministic approaches are enough; and AI agents and LLM-backed workflows where reasoning, summarization, or judgment is required, such as evidence-to-control mapping, attestation drafting, drift detection, and audit-package assembly. This position belongs to a family of jobs with increasing responsibility, competency, and skill level. Actual position title and pay grade will be based on the selected candidate’s experience and qualifications.

  Location: San Antonio, Texas. Additional locations: Findlay, Ohio, Houston, Texas.

  Then Responsibilities.

  Responsibilities

  • Conducts detailed analyses on changes to cybersecurity solutions and its relationship to internal and external systems to assess control effectiveness and cybersecurity risk.
  • Resolves complex multi-functional technical issues.
  • Leverages cybersecurity assessments, standards, control testing methodologies, and compliance frameworks to ensure compliance across security systems.
  • Improves the efficiency and effectiveness of Security solutions, governance processes, automated controls, and monitoring capabilities.
  • Analyzes existing processes and procedures and leads efforts for implementing improvements, automation opportunities, or remediation activities.
  • Responsible for development and submission of Standard Operating Procedures.
  • Analyzes business impacting events, performs initial investigation, and evaluates control performance, exceptions, and risk indicators through continuous monitoring activities.
  • Investigates and analyzes the nature and scope of cyber incidents, control failures, and compliance exceptions. Assists in the development of risk mitigation and remediation plans to ensure regulatory and internal compliance.
  • Leads implementation of global security initiatives, policies, compliance requirements, and continuous control monitoring practices.
  • Collects, validates, and reports security metrics, control performance results, and remediation efforts associated with them.
  • Manages cyber security-related consulting, guidance, and support to customers and stakeholders.
  • Translates security principles to assist configuration teams with incorporating security and compliance requirements into build and configuration processes.
  • Monitors emerging IT/OT, cybersecurity, automation, and artificial intelligence technologies as well as their impact on the security, risk, and compliance landscape.
  Then Requirements (or Qualifications). We'll use

  Requirements

  for mandatory items. List: - Bachelor’s Degree in Information Technology, related field or equivalent experience. - 5+ years of relevant experience required - Experience designing, implementing, and scaling GRC, CCM, or compliance automation solutions within a regulated environment required - Experience in Python or comparable automation technologies, proficient in developing, integrating, and supporting automated workflows and REST API-based data integrations across multiple enterprise systems required. - Hands-on experience integrating security-control data sources into a GRC / CCM evidence pipeline for continuous control testing required. This includes normalizing API, telemetry, configuration, vulnerability, identity, ticketing, and assessment data into control-level evidence, exception logic, ownership, frequency, and audit-ready records across at least three domains such as CNAPP / CSPM, SIEM / security data lake / XDR, CTEM / VM / ASPM, DSPM, ITSM, IAM, GRC / CCM, or AI/agent governance required. - Experience building LLM-backed agentic workflows on Azure AI Foundry, GitHub, or open-source frameworks preferred.