IT Senior Security Engineer - Governance, Risk, and Compliance

About the job

How you'll help us Keep Climbing (overview & key responsibilities)

At Delta, we connect people and cultures, power extraordinary experiences, and shape the future of travel. Here, you'll work on complex challenges on a global scale, using augmented intelligence to build emerging technologies, amplify human potential and continuously grow the skills that keep you at the forefront of what's next.

The Sr. Security Engineer - Governance, Risk, and Compliance is a rare hybrid: a strategic governance leader and a hands-on automation engineer. This person excels at both the strategy and execution needed to ensure the Information Security Governance team drives organizational behavior change, fosters a security-first culture, and reduces risk through well-defined policies, standards, and measurable security outcomes.

This is as much a builder's role as it is a governance role. You will define Delta's Information Security Standards and maintain mappings to regulatory and industry frameworks. You will also design, build, and deploy automation solutions that collect, calculate, and visualize security control effectiveness and KPI data, providing leadership with real-time insight into security posture and risk.

You will create new processes, tooling, and scalable solutions within a team transforming how Information Security supports the business and protects the information entrusted to us by customers, employees, and partners. Working closely with engineers, architects, tool owners, and security leaders across domains including Cloud Security, PKI, Network Security, and IoT/OT Security, you will drive alignment, enable others to build secure solutions, and solve complex security challenges at enterprise scale.

• Provide Policy and Standards subject-matter leadership through the development and maintenance of Delta’s Information Security Policy, Standards, and procedures — updating them at least annually, ensuring alignment with applicable frameworks and regulations, and ensuring they are clear and understandable at all levels of the organization, from technical teams to frontline personnel.
• Own and maintain the mapping of Information Security Standards to authoritative regulatory frameworks (e.g., NIST 800-53, NIST 800-171, PCI DSS, SOX, ISO 27001) and sustain the full compliance-traceability chain — from authoritative source through standard, control, evidence, findings, and exceptions — within Delta’s GRC platform (RSA Archer), including the governed, auditable standards-change approval workflow and Domain Owner review model.
• Design, build, and deploy automated security control tests and metric collectors — writing production code (Python, Infrastructure-as-Code) that connects to security tools’ APIs, calculates coverage, risk-reduction, and process/governance metrics, and publishes results to the GRC platform and to Information Security dashboards for leadership.
• Develop and own Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) end-to-end — from identifying the right metric with tool owners, through calculation logic, to real-time visualization — to measure the effectiveness of Delta’s Information Security program.
• Establish reusable engineering patterns, templates, and developer tooling (including AI-assisted development agents, automation scripts, and documentation standards) that enable tool owners and other engineers to contribute to metric automation quickly and consistently, scaling delivery beyond a single engineer.
• Shepherd changes to production through the enterprise change-management process — authoring Request for Change (RFC) documents, answering Change Advisory Board (ECAB) questions, and coordinating deployments with zero-incident execution.
• Advance security documentation and guidance — including publishing standards, supplemental guidance, and emerging-technology mandates (such as AI security mandates and cloud/SaaS security requirements) — on Delta’s internal documentation platforms in clear, plain language.
• Improve Delta’s security positioning through process improvement, policy, automation, and the continuous evolution of capabilities; identify automation opportunities and provide innovative, risk-based insights to inform Information Security leadership.
• Help develop a strong security-driven culture where security is part of every employee’s day-to-day operations and attitudes, and communicate the value of Information Security to key stakeholders.
• Tackle “big” problems, provide options, and drive resolution.

Benefits and Perks to Help You Keep Climbing

Our culture is rooted in a shared dedication to living our values – Care, Integrity, Resilience and Servant Leadership – every day, in everything we do. At Delta, our people are our success. At the heart of what we offer is our focus on Sharing Success with Delta employees. Exploring a career at Delta gives you a chance to see the world while earning great compensation and benefits to help you keep climbing along the way:

• Competitive salary, industry-leading profit sharing program, and performance incentives

• 401(k) with generous company contributions up to 9%

• New hires are eligible for up to 2-weeks of vacation. This is earned for use in the following vacation year (April 1 – March 31)

• In addition to vacation, new hires are eligible for up to 56 hours of paid personal time within a 12-month period

• 10 paid holidays per calendar year

• Birthing parents are eligible for 12-weeks of paid maternity/parental leave

• Non-birthing parents are eligible for 2-weeks of paid parental leave

• Comprehensive health benefits including medical, dental, vision, short/long term disability and life insurance benefits

• Family care assistance through fertility support, surrogacy and adoption assistance, lactation support, subsidized back-up care, and programs that help with loved ones in all stages

• Holistic Wellbeing programs to support physical, emotional, social, and financial health, including access to an employee assistance program offering support for you and anyone in your household, free financial coaching, and extensive resources supporting mental health

• Domestic and International space-available flight privileges for employees and eligible family members

• Career development programs to achieve your long-term career goals

• World-wide partnerships to engage in community service and innovative goals created to focus on sustainability and reducing our carbon footprint

• Business Resource Groups created to connect employees with common interests to promote inclusion, provide perspective and help implement strategies

• Recognition rewards and awards through the platform Unstoppable Together

• Access to over 500 discounts, specialty savings and voluntary benefits through Deltaperks such as car and hotel rentals and auto, home, and pet insurance, legal services, and childcare

What you need to succeed (minimum qualifications)

• Is at least 18 years of age and has authorization to work in the United States.
• Possesses a high school diploma, GED, or high school equivalency.
• Embraces diverse people, thinking, and styles.
• Consistently prioritizes safety and security of self, others, and personal data.
• Ability to interact confidently with various levels of technical and leadership positions.
• Exceptional communication skills — the ability to tell compelling stories through excellent writing, form a clear point of view on complicated issues, and create concise, well-written narratives. A natural teacher who puts points across engagingly and inspires interest in information security.
• Hands-on software development ability — proficiency in at least one programming or scripting language (e.g., Python, TypeScript/JavaScript, PowerShell) and the ability to build, test, and deploy working automation, not just specify it.
• Proven experience (5+ years) in governance, risk, or compliance roles working with one or more of the following frameworks: PCI DSS, SOX, NIST 800-171, NIST 800-53, CIS.
• Familiarity with applying and leveraging AI/GenAI responsibly — for example AI-assisted development tooling and AI governance frameworks (AI security mandates, model governance, secure AI patterns).
• Experience creating and writing security policies or standards in support of organizational security programs or system accreditations, and mapping them to regulatory frameworks.
• Ability to create metrics, documentation, presentations, and procedures that communicate results effectively to both technical and executive audiences.
• Demonstrated customer focus — evaluates decisions through the eyes of the customer, builds strong relationships, and designs processes from the customer’s viewpoint.
• Organized and detail-oriented, able to work under deadlines in a changing environment and deliver multiple projects effectively and concurrently.
• High degree of initiative with the ability to manage multiple tasks, work under pressure, and meet deadlines.
• Strong interpersonal, leadership, problem-solving, prioritization, presentation, and facilitation skills, with the ability to make recommendations to all levels of the organization.
• Demonstrated ability to work independently and collaboratively.

What will give you a competitive edge (preferred qualifications)

• Bachelor’s degree or higher in a relevant field (information systems, cybersecurity, computer science, communications, or behavioral science).
• Hands-on automation or software-development experience — building, testing, and deploying production automation, scripts, or applications (ideally in a security, compliance, or data-integration context).
• Experience with cloud and serverless development — for example AWS Lambda, API Gateway, DynamoDB, SQS, EventBridge, Secrets Manager, and Infrastructure-as-Code (AWS CDK / SAM) — and CI/CD pipeline management (e.g., GitLab).
• Experience building front-end or dashboard applications to visualize security posture and metrics.
• Experience with RSA Archer or an equivalent GRC platform, including its APIs and integrations.
• Exposure to relevant standards and regulations such as ISO/IEC 27001 and 27002, NIST 800 series, COBIT, PCI DSS, SOX, HIPAA, GDPR, and emerging frameworks (e.g., CMMC, EU AI Act).
• Experience developing executive presentations or status communications for multiple organizational roles.
• A history of driving transformational change and building relationships across IT and the Business.
• Excellent analytical and problem-solving skills, with meticulous attention to detail and accuracy.
• CISSP, CISA, CISM, Security+, or other relevant security certifications.