Staff Cybersecurity Education and Awareness Manager

General Motors • Full-time • United States • 1w ago

The Role

The Staff Cybersecurity Education and Awareness Manager is responsible for building and sustaining a strong, resilient security culture across General Motors by designing and delivering education, awareness, and communication programs that reduce human risk and promote secure behaviors. This role will translate GM’s cybersecurity strategy and policy into clear, approachable experiences that help employees and contractors understand their responsibilities and take action in their day-to-day work.

The ideal candidate combines deep understanding of cybersecurity concepts with strong communication, storytelling, and change management skills. They will influence behavior at scale, ensure employees have simple, accessible pathways to engage with GM’s cybersecurity organization, and support a culture where cybersecurity is recognized as a shared responsibility.

What You'll Do:

Culture, Strategy & Governance

Foster a positive, empowering security culture that emphasizes accountability, learning, and “secure by default” behaviors rather than fear or blame.

Develop and maintain a GM-wide security education and enablement strategy aligned to enterprise risk priorities, NIST CSF principles, and GM cybersecurity policies and standards.

Help define a multi-year roadmap for security education and culture initiatives, including annual objectives, key milestones, and integration with broader cybersecurity and IT strategies.

Ensure programs align with GM’s values and vision (e.g., Zero Crashes, Zero Emissions, Zero Congestion) and reinforce that cybersecurity is foundational to safety, quality, and customer trust.

Education, Training & Campaigns

Design and deliver engaging, role-based cybersecurity training (e.g., targeted modules for high-risk roles such as developers, third-party facing teams, etc.).

Lead the evolution from point-in-time training and one-off phishing exercises to a continuous, data-informed engagement program, sunsetting legacy approaches in favor of more modern, behavior-focused methods.

Use modern learning techniques (e.g., microlearning, just-in-time nudges, gamification, simulations, labs) to drive knowledge retention and real behavior change.

Enterprise Enablement

Collaborate with key learning and culture teams across the enterprise to embed and enable cybersecurity education and culture initiatives within their areas of responsibility

Design and scale a Security Champions network across functions, sites, and regions to localize security messages, gather feedback, and amplify best practices within teams.

Equip leaders at all levels (from senior executives to frontline managers) with information and communication tools they can use in staff meetings, town halls, and performance discussions.

Create and manage recognition programs that celebrate secure behaviors and contributions to GM’s cybersecurity posture.

Human Risk Management & Insights

Use data-driven insights to understand human risk across GM (e.g., phishing resilience, reporting behavior, policy exceptions, unsafe tool usage) and identify high-risk personas, processes, or environments.

Define and track key performance indicators (KPIs) and outcomes related to security behavior (e.g., click rates and report rates, training completion and assessment scores, time-to-remediate user-driven risks, participation in key campaigns).

Collaborate with Cyber Defense, Insider Threat, and Risk & Compliance teams to connect human risk insights with broader cyber metrics and dashboards, and to prioritize targeted interventions where they matter most.

Partner with the GM Threat Intelligence team to convert real‑time cyber threat intelligence into relevant, actionable training that helps employees recognize and report emerging threats (e.g., new phishing campaigns and attacker tactics), strengthening our workforce as a proactive layer of defense.

Cybersecurity Communications & Engagement

Help redesign and manage core internal cybersecurity communication channels, including intranet pages, slack messaging, email campaigns, and executive storytelling.

Ensure employees have clear, well-documented workflows and resources to:

Report suspected phishing and cyber incidents

Request cybersecurity support or guidance

Access up-to-date policies, standards, and best practices in a user-friendly way

Develop messaging and campaigns for new or updated policies, emerging threats, incidents, and strategic initiatives, collaborating closely with Cybersecurity Policy, Cyber Defense, and other subject-matter experts.

Partner with Corporate Communications and HR to align cyber messaging with broader company communications and culture narratives.

Metrics, Reporting & Continuous Improvement

Establish a measurement framework and regular reporting cadence that provides the CISO and senior leadership with clear visibility into the effectiveness of security education and culture initiatives (e.g., dashboards, scorecards, quarterly readouts).

Use experimentation (e.g., A/B testing of messages, pilots with specific functions, gamified challenges) to continuously refine approaches based on what drives measurable behavior change.

Stay current on emerging threats, human risk trends, and best practices in security awareness, culture, and behavior science; incorporate learnings into GM’s programs to keep them fresh, relevant, and impactful.

Your Skills & Abilities (Required Qualifications):

8+ years of experience in cybersecurity awareness, security education, learning & development, communications, organizational change management, or related fields.

Strong understanding of cybersecurity principles, human risk management, and behavior change strategies; experience applying these concepts in large, complex organizations is preferred.

Hands-on experience with:
- Security awareness and training platforms
- Phishing simulation and human risk tools
- Analytics / reporting solutions for measuring behavior and campaign impact

Excellent communication skills—able to translate technical concepts and policy requirements into simple, clear, and actionable messages for non-technical audiences across different regions and job functions.

Proven ability to influence without direct authority, build trust with senior stakeholders, and collaborate across multiple teams and time zones.

Experience designing and delivering modern learning experiences (e.g., microlearning, gamification, scenario-based learning, interactive workshops) that drive measurable behavior change.

Bachelor degree in Cybersecurity, Information Systems, Communications, Education, Organizational Psychology, or a related field; or equivalent practical experience.

What Will Give You A Competitive Edge (Preferred Qualifications):

10+ years of experience in cybersecurity awareness, security education, learning & development, communications, organizational change management, or related fields.
Professional certifications such as CISSP, CISM, Security+, or a Security Awareness / Human Risk certification.
Master degree in Cybersecurity, Information Systems, Communications, Education, Organizational Psychology, or a related field.

Why This Role Matters

Human behavior is one of GM’s most critical attack surfaces and the first line of defense against cyber threats. Every employee, contractor, and partner has a role to play in protecting GM’s customers, intellectual property, operations, and brand.

This role ensures GM’s workforce is informed, engaged, and empowered to make secure choices in their daily work—whether they are designing vehicles, writing software, working in plants, partnering with suppliers, or serving customers. By making cybersecurity approachable, actionable, and integrated into how we work, the Security Education, Culture & Enablement Lead directly supports GM’s mission and long-term resilience.

Company Vehicle: Upon successful completion of a motor vehicle report review, you will be eligible to participate in a company vehicle evaluation program, through which you will be assigned a General Motors vehicle to drive and evaluate. Note: program participants are required to purchase/lease a qualifying GM vehicle every four years unless one of a limited number of exceptions applies.