Staff Product Cybersecurity Engineer - Offensive Product Security

About the Role

The Staff Product Cybersecurity Engineer, Offensive Product Security role is part of the broader Product Cybersecurity organization at General Motors. This role focuses on offensive security services to enhance the security of our product portfolio. Through penetration testing, red-team activities, and security research, the engineer identifies vulnerabilities in software, systems, and product implementations across embedded vehicle software, mobile experiences, and product-backed software and services. The role collaborates closely with product teams to assess real-world attack paths, validate risks, and provide actionable findings to improve our secure SDLC.

Responsibilities

• Perform penetration testing across software, systems, and product environments
• Conduct security research targeting meaningful product and technology risks
• Execute offensive assessments across embedded, mobile, and backend environments
• Identify vulnerabilities, validate impact, and provide clear remediation guidance
• Partner with engineering teams to improve security through practical technical findings
• Strengthen offensive methods, tooling, and testing approaches across the portfolio

Requirements

• 8+ years of experience in penetration testing, product security, security research, or similar roles
• Deep expertise in offensive security testing across applications, software, and systems
• Experience with penetration testing, red-team activity, vulnerability research, and exploit validation
• Familiarity with embedded security, operating system security, application security, and networking
• Ability to read-and-write software in multiple languages to support investigation and tooling
• Strong communication skills to convey technical findings and collaborate with engineers on remediation

Qualifications

• Prior role(s) in the automotive industry or a similarly complex, deadline-driven, and regulated field (preferred)
• Direct experience working on automotive security across the secure SDLC (preferred)
• Published cybersecurity research projects (e.g., conference talks, blog posts, code repositories) (preferred)
• Experience building custom offensive tooling or extending existing security testing capabilities (preferred)

Skills

• Deep technical curiosity and strong offensive security instincts across complex product focuses
• Rigorous and detail-oriented approach to technical investigation and exploit validation
• Clear judgment on risk, exploitability, and practical impact across software and systems
• Ability to work independently on complex technical problems and ambiguous attack surfaces
• Commitment to helping engineers improve security through detailed, risk-ranked findings

This role is categorized as hybrid, requiring on-site presence at least 3 times a week. Relocation benefits may be available. GM does not provide immigration-related sponsorship for this position.