Staff Cybersecurity Education and Awareness Manager

The Role

The Staff Cybersecurity Education and Awareness Manager is responsible forbuilding and sustaining a strong resilient security culture across General Motors by designing and delivering education awareness and communication programs that reduce human risk and promote secure behaviors.This role will translate GMs cybersecurity strategy and policy into clear approachable experiences that help employees and contractors understand their responsibilities andtake actionin their day-to-day work.

The ideal candidate combinesdeepunderstanding of cybersecurity concepts withstrong communication storytelling and change management skills. They will influence behavior at scale ensure employees have simple accessible pathways to engage with GMs cybersecurity organization and support a culture where cybersecurity is recognized as a shared responsibility.

What Youll Do:

Culture Strategy & Governance

• Foster a positive empowering security culturethat emphasizes accountability learning and secure by default behaviors rather than fear or blame.

• Develop andmaintaina GM-wide security education and enablement strategyaligned to enterprise risk priorities NIST CSF principles and GM cybersecurity policies and standards.

• Help define a multi-year roadmapfor security education and culture initiatives including annualobjectives key milestones and integration with broader cybersecurity and IT strategies.

• Ensure programs align with GMs values and vision (e.g. Zero Crashes Zero Emissions Zero Congestion) and reinforce that cybersecurity is foundational to safety quality and customer trust.

Education Training & Campaigns

• Design and deliver engaging role-based cybersecurity training(e.g. targeted modules for high-risk roles such as developers third-party facing teams etc.).

• Lead the evolution from point-in-time training and one-off phishing exercises to acontinuous data-informed engagement programsunsettinglegacy approaches in favor of more modern behavior-focused methods.

• Use modern learning techniques (e.g. microlearning just-in-time nudges gamification simulations labs) to driveknowledgeretention and real behavior change.

Enterprise Enablement

• Collaborate with key learning and culture teams across the enterpriseto embed and enable cybersecurity education and culture initiatives within their areas of responsibility

• Design and scale a Security Champions network across functions sites and regions to localize security messages gather feedback and amplify best practices within teams.

• Equip leaders at all levels (from senior executives to frontline managers) withinformationand communication toolsthey can use in staff meetings town halls and performance discussions.

• Create and managerecognition programsthat celebrate secure behaviors and contributions to GMs cybersecurity posture.

Human Risk Management & Insights

• Use data-driven insights to understand human risk across GM (e.g. phishing resilience reporting behavior policy exceptions unsafe tool usage) andidentifyhigh-risk personas processes or environments.

• Define and track key performance indicators (KPIs) and outcomes related to security behavior (e.g. click rates and report rates training completion and assessment scores time-to-remediate user-driven risks participation in key campaigns).

• Collaborate with Cyber Defense Insider Threat and Risk & Compliance teams to connect human risk insights with broader cyber metrics and dashboards and to prioritize targeted interventions where they matter most.

• Partner with the GM Threat Intelligence team to convert realtime cyber threat intelligence into relevant actionable training that helps employees recognize and report emerging threats (e.g. new phishing campaigns and attacker tactics) strengthening our workforce as a proactive layer of defense.

Cybersecurity Communications & Engagement

• Help redesign and manage core internal cybersecurity communication channels including intranet pages slack messaging email campaigns and executive storytelling.

• Ensure employees haveclear well-documented workflowsand resources to:

• Report suspected phishing and cyber incidents

• Request cybersecurity support or guidance

• Access up-to-date policies standards and best practices in a user-friendly way

• Develop messaging and campaigns fornew or updated policies emerging threats incidents and strategic initiatives collaborating closely with Cybersecurity Policy Cyber Defense and other subject-matter experts.

• Partner with Corporate Communications and HR to align cyber messaging with broader company communications andculturenarratives.

Metrics Reporting & Continuous Improvement

• Establish a measurement framework andregular reporting cadencethat provides the CISO and senior leadership with clear visibility into the effectiveness of security education and culture initiatives (e.g. dashboards scorecards quarterly readouts).

• Use experimentation (e.g. A/B testing of messages pilots with specific functions gamified challenges) to continuously refine approaches based on what drives measurable behavior change.

• Stay current on emerging threats human risk trends and best practices in security awareness culture and behavior science; incorporate learnings into GMs programs to keep them fresh relevant and impactful.

Your Skills & Abilities (Required Qualifications):

• 8 years of experience in cybersecurity awareness security education learning & development communications organizational change management or related fields.

• Strong understanding ofcybersecurity principles human risk management and behavior changestrategies; experience applying these concepts in large complex organizations is preferred.

• Hands-on experience with:

  • Security awareness and training platforms

  • Phishing simulation and human risk tools

  • Analytics / reporting solutions for measuring behavior and campaign impact

• Excellent communication skillsable to translate technical concepts and policy requirements into simple clear and actionable messages for non-technical audiences across different regions and job functions.

• Proven ability toinfluence without direct authority build trust with senior stakeholders and collaborate across multiple teams and time zones.

• Experience designing and deliveringmodern learning experiences(e.g. microlearning gamification scenario-based learning interactive workshops) that drive measurable behavior change.

• Bachelor degreein Cybersecurity Information Systems Communications Education Organizational Psychology or a related field; or equivalent practical experience.

What Will Give You A Competitive Edge (Preferred Qualifications):

• 10 years of experience in cybersecurity awareness security education learning & development communications organizational change management or related fields.

• Professional certifications such asCISSP CISM Security oraSecurityAwareness / Human Riskcertification.

• Master degreein Cybersecurity Information Systems Communications Education Organizational Psychology or a related field.

Why This Role Matters

Human behavior is one of GMs most critical attack surfaces and the first line of defense against cyber threats. Every employee contractor and partner has a role to play in protecting GMs customers intellectual property operations and brand.

This role ensures GMs workforce is informed engaged and empowered to make secure choices in their daily workwhether they are designing vehicles writing software working in plants partnering with suppliers or serving customers. By making cybersecurity approachable actionable and integrated into how we work the Security Education Culture &EnablementLead directly supports GMs mission and long-term resilience.

Company Vehicle: Upon successful completion of a motor vehicle report review you will be eligible to participate in a company vehicle evaluation program through which you will be assigned a General Motors vehicle to drive and evaluate. Note: program participants are required to purchase/lease a qualifying GM vehicle every four years unless one of a limited number of exceptions applies.