IT Senior Security Engineer - Governance, Risk, and Compliance

How you'll help us Keep Climbing (overview & key responsibilities)

At Delta, we connect people and cultures, power extraordinary experiences, and shape the future of travel. Here, you'll work on complex challenges on a global scale, using augmented intelligence to build emerging technologies, amplify human potential and continuously grow the skills that keep you at the forefront of what's next.

The Sr. Security Engineer - Governance, Risk, and Compliance is a rare hybrid: a strategic governance leader and a hands-on automation engineer. This person excels at both the strategy and execution needed to ensure the Information Security Governance team drives organizational behavior change, fosters a security-first culture, and reduces risk through well-defined policies, standards, and measurable security outcomes.

This is as much a builder's role as it is a governance role. You will define Delta's Information Security Standards and maintain mappings to regulatory and industry frameworks. You will also design, build, and deploy automation solutions that collect, calculate, and visualize security control effectiveness and KPI data, providing leadership with real-time insight into security posture and risk.

You will create new processes, tooling, and scalable solutions within a team transforming how Information Security supports the business and protects the information entrusted to us by customers, employees, and partners. Working closely with engineers, architects, tool owners, and security leaders across domains including Cloud Security, PKI, Network Security, and IoT/OT Security, you will drive alignment, enable others to build secure solutions, and solve complex security challenges at enterprise scale.

Provide Policy and Standards subject-matter leadership through the development and maintenance of Delta’s Information Security Policy, Standards, and procedures — updating them at least annually, ensuring alignment with applicable frameworks and regulations, and ensuring they are clear and understandable at all levels of the organization, from technical teams to frontline personnel.

Own and maintain the mapping of Information Security Standards to authoritative regulatory frameworks (e.g., NIST 800-53, NIST 800-171, PCI DSS, SOX, ISO 27001) and sustain the full compliance-traceability chain — from authoritative source through standard, control, evidence, findings, and exceptions — within Delta’s GRC platform (RSA Archer), including the governed, auditable standards-change approval workflow and Domain Owner review model.

Design, build, and deploy automated security control tests and metric collectors — writing production code (Python, Infrastructure-as-Code) that connects to security tools’ APIs, calculates coverage, risk-reduction, and process/governance metrics, and publishes results to the GRC platform and to Information Security dashboards for leadership.

Develop and own Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) end-to-end — from identifying the right metric with tool owners, through calculation logic, to real-time visualization — to measure the effectiveness of Delta’s Information Security program.

Establish reusable engineering patterns, templates, and developer tooling (including AI-assisted development agents, automation scripts, and documentation standards) that enable tool owners and other engineers to contribute to metric automation quickly and consistently, scaling delivery beyond a single engineer.

Shepherd changes to production through the enterprise change-management process — authoring Request for Change (RFC) documents, answering Change Advisory Board (ECAB) questions, and coordinating deployments with zero-incident execution.

Advance security documentation and guidance — including publishing standards, supplemental guidance, and emerging-technology mandates (such as AI security mandates and cloud/SaaS security requirements) — on Delta’s internal documentation platforms in clear, plain language.

Improve Delta’s security positioning through process improvement, policy, automation, and the continuous evolution of capabilities; identify automation opportunities and provide innovative, risk-based insights to inform Information Security leadership.

Help develop a strong security-driven culture where security is part of every employee’s day-to-day operations and attitudes, and communicate the value of Information Security to key stakeholders.

Tackle “big” problems, provide options, and drive resolution.