Cybersecurity Services Analyst

The Connected Vehicle Ecosystem Cybersecurity team is directly engaged in securing end-to-end connected vehicle features. This role will provide senior technical leadership for the development and delivery of secure, globally connected vehicle applications and capabilities, with emphasis on identity and access management, cloud and mobile security, threat modeling, penetration testing, DevSecOps, cryptographic controls, and emerging AI security.

• Provide senior-level cybersecurity expertise for connected vehicle and mobility products, services, applications, and supporting platforms, using threat intelligence and data analysis to guide risk-based decisions.
• Lead threat modeling, architecture and design reviews, attack-path analysis, and security assessments across cloud, mobile, in-vehicle, API, and identity-dependent solutions, including REST and event-driven API attack surfaces.
• Define, publish, and continuously improve security specifications, patterns, standards, and policies for connected vehicle products and features.
• Establish and govern API security requirements covering authentication, authorization, token and credential handling, input validation, rate limiting, data protection, logging, inventory, versioning, and secure retirement.
• Operate security governance processes for findings and exceptions, including intake, triage, risk classification, control-owner assignment, remediation tracking, risk acceptance, escalation, metrics, and closure evidence.
• Manage the penetration and API security testing lifecycle, including scope definition, test coordination, authentication and authorization testing, findings review, risk prioritization, remediation guidance, and validation of high-impact fixes.
• Partner with product, engineering, architecture, operations, and business stakeholders to translate vulnerabilities and technical findings into clear business risk and practical control recommendations.
• Drive security integration into DevSecOps and software delivery pipelines through automated scanning, security gates, compliance checks, and actionable feedback for engineering teams.
• Guide identity and access management designs, including multifactor authentication, authorization, federation, token usage, service-to-service trust, and least-privilege access.
• Provide technical direction for cryptographic controls, including encryption, certificate management, keys, tokens, and mutual TLS across multi-platform environments.
• Lead vulnerability and cybersecurity incident triage, validate severity and exploitability, identify ownership, coordinate remediation, manage exceptions, and track issues through risk acceptance or verified closure.
• Serve as a cybersecurity point of contact and consultant for complex security research, product evaluations, and cross-functional initiatives.
• Conduct security assessments for GenAI, large language models, AI agents, and machine learning platforms, including AI threat modeling, red teaming, adversarial testing, guardrails, RAG security, identity protections, monitoring, and governance.
• Work independently, take ownership of deliverables, mentor less-experienced team members, and communicate decisions, risks, and progress to technical and non-technical audiences.
  
  

Minimum Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related technical field.
• 5+ years of experience in cybersecurity, security architecture, software engineering, or a closely related technical role.
• 5+ years of combined experience with cloud applications, mobile applications, APIs, identity platforms, or distributed software systems.
• Hands-on experience leading threat modeling, security architecture reviews, vulnerability analysis, or penetration testing activities.
• Hands-on experience with API security testing and vulnerability triage, including assessment of authentication, authorization, data exposure, input handling, and business-logic risks.
• Working knowledge of secure software development practices and the ability to partner effectively with engineering teams throughout the development lifecycle.
• Experience communicating technical security risks and remediation recommendations to engineering, product, and leadership stakeholders.
  
  

Preferred Qualifications

• Strong knowledge of identity and access management, including MFA, OAuth 2.0, OpenID Connect, SAML, authorization tokens, identity federation, and service identities.
• Practical expertise with cryptography and transport security, including encryption, certificates, key management, digital signatures, and mutual TLS.
• Experience securing applications and services operating in multi-cloud environments, particularly Google Cloud Platform and Microsoft Azure.
• Knowledge of one or more relevant development technologies, such as Java, Python, React, Swift, Kotlin, XML, REST APIs, and network sockets.
• Experience with API security testing and automation, including REST API assessment, authentication and authorization validation, negative testing, fuzzing, secure code review, and penetration testing.
• Experience governing security findings, policy exceptions, risk acceptances, remediation commitments, security metrics, and evidence-based closure across multiple engineering teams.
• Experience implementing or governing automated security testing within CI/CD, DevSecOps, or MLOps pipelines.
• Knowledge of connected vehicle, automotive, IoT, telematics, mobility, or other cyber-physical ecosystems.
• Experience assessing GenAI, LLM, AI-agent, RAG, or machine-learning solutions and defining security controls for their deployment.
• Relevant security certifications such as CISSP, CSSLP, CCSP, OSCP, CEH, or cloud security certifications are advantageous.
  
  

Core Competencies

• Technical leadership and sound security judgment in ambiguous, cross-domain environments.
• Risk-based prioritization and the ability to balance security, customer experience, delivery, and operational needs.
• Clear written and verbal communication, including concise executive-level risk framing.
• Collaboration across global, cross-functional, and culturally diverse teams.
• Ownership, initiative, structured problem solving, and continuous learning.