{"id":2892238,"url":"https://alion.io/job/carmax-engineer-ii-cybersecurity-application-security","title":"Engineer II, Cybersecurity - Application Security","company":{"id":1759292,"name":"CarMax","domain":"carmax.com","url":"https://alion.io/company/carmax-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":86,"open_postings":83,"ghost_share":0,"stale_share":0.747,"repost_share":0,"time_to_fill_p50_days":19,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Richmond, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":80600,"max":120900,"currency":"USD","period":"year","gross":null,"usd_annual":120900},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":".NET","optional":false},{"name":"C#","optional":false},{"name":"JavaScript","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"Azure DevOps","optional":true},{"name":"GCP","optional":true},{"name":"GitHub","optional":true},{"name":"Kubernetes","optional":true},{"name":"TeamCity","optional":true}],"status":"live","first_seen_at":"2026-08-05T00:00:00Z","employer_posted_date":"2026-08-05","last_verified_at":"2026-10-31T17:48:47Z","board_verified":true,"closed_at":null,"days_open":87,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":87},"description":"8901 - Corp Office West Crk - 12800 Tuckahoe Creek Parkway, Richmond, Virginia, 23238CarMax, the way your career should be!\nJob Description\nThe Cybersecurity Engineer II in our Application Security Program plays a key role in enhancing the security program for a company and national brand that has been listed on the Fortune 100 Best Places to Work. We work in a collaborative environment where your ideas can help shape the direction and development of critical security capabilities. You will work with a team of talented professionals that are keenly focused on solving complex security challenges and supporting product innovation with technology. Our team is not afraid to fail fast, learn and are motivated to find ways to make things better. This role requires you to be flexible, adaptable to change, and willing to ask questions that lead to security posture improvements for CarMax.\nWhat you will do - Essential Responsibilities:\nImplement, develop, operate, and improve Cybersecurity solutions utilized for to progress Application Security at CarMax including static and dynamic analysis, API Sec, and Container Sec. Provide functional and technical expertise on projects that have application security implications for our Company.\n\nLearn and understand the full portfolio of Cybersecurity capabilities at CarMax and how they work together to secure or enterprise.\n\nIndependently drive tasks and projects to successful completion through effective time and schedule management, customer interaction, and cross functional team interaction\n\nEffectively triage support problems and respond with the appropriate level of urgency Participate in a 24x7 on-call weekly rotation as scheduled, and the ability to perform after hours support as needed. Current rotation is about 3 weeks per year.\n\nQualification Requirements:\nStrong fundamentals in general Cybersecurity concepts with an interest in learning more about and contributing to Application Security\n\nFunctional understanding with at least one coding or scripting language: e.g. PowerShell, Python, .Net, Javascript, C#\n\nExcellent analytical, troubleshooting, and problem-solving skills and performs well in high pressure or stressful situations\n\nExcellent organization and time management skills\n\nExcellent communication skills to include, but not limited to, verbal and written communication; delivering organized presentations; able to tailor message to the audience; and facilitate group discussions with diplomacy and seek diverse opinions\n\nAbility to effectively estimate the efforts of others and the impact required to accomplish requested tasks/projects\n\n Preferred Qualifications\nFunctional proficiency with at least one coding or scripting language\n\nExperience performing dynamic application security testing (DAST) using open source and commercial tools.\n\nExperience performing static security code analysis (SAST) and providing relevant recommendations to stakeholders.\n\nExperience integrating security into the container lifecycle, including image assurance, Kubernetes posture management, secrets management, and runtime threat detection\n\n Education and/or Experience:\nBachelor’s Degree in Computer Science, Engineering, Cybersecurity, or a related field, or equivalent alternative education, skills, and/or practical experience is required.\n\n2+ years of work experience required in Cybersecurity or other areas directly relevant to cybersecurity responsibilities and tasks.\n\nKnowledge of developer tools like GitHub, Azure DevOps, and TeamCity.\n\nExperience with Public Cloud: e.g. Azure, AWS, GCP.\n\nUnderstanding of development and product teams and DevSecOps best practices.\n\nCISSP certification preferred but not required.\n\nWork Location and Arrangement: This role will be based out of the CarMax Home Office at West Creek (Richmond, VA) and associates will work onsite 4 days per week.\nWork Authorization: Applicants must be currently authorized to work in the United States on a full-time basis.\nAbout CarMax\nCarMax disrupted the auto industry by delivering the honest, transparent and high-integrity experience customers want and deserve. This innovative thinking around the way cars are bought and sold has helped us become the nation’s largest retailer of used cars, with over 200 locations nationwide.\nOur amazing team of more than 25,000 associates work together to deliver iconic customer experiences. Along the way, we help every associate grow their career and achieve their best, at work and in their community. We are recognized for our commitment to training and diversity and are one of the FORTUNE 100 Best Companies to Work For®.\nOur Commitment to Diversity and Inclusion:\nCarMax is committed to bringing together people from different backgrounds and perspectives, providing employees with a safe, welcoming, and inclusive work environment.\nCarMax is an equal opportunity employer, and all qualified candidates will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity, genetic information, national origin, protected veteran status, disability status, or any other characteristic protected by law.\nThe annual salary for this position is:\n$80,600.00 - $120,900.00May be eligible for bonus and equity.\nBenefits:\nExcept as otherwise required by state law, CarMax Associates are entitled to the following paid sick, vacation, and holiday time.\nAssociates that are considered full-time hourly or commission/incentive eligible:\nTo earn up to 48 hours of sick time per year accrued on a per pay period basis and between 80 hours and 200 hours per year of vacation time after a 90 day waiting period depending on years of continuous service with the Company. \nFor 8 hours of pay for each of a total of 6 paid scheduled holidays per year plus 1 floating holiday. If such an Associate does work on a scheduled holiday due to business need, they are eligible for Holiday Premium Pay. \nAssociates considered full-time salaried are entitled to paid time away with no specified limit as needed for sick, vacation, bereavement, jury duty, holidays, floating holiday, etc. subject to manager approval.\nFor more details about benefits, please visit our CarMax Benefits website.\nUpon an applicant's request, CarMax will consider reasonable accommodation to complete the CarMax Job Application.","description_format":"text","description_chars":6346,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Home office"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[{"name":"Central African Republic","iso":"CF"}],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Application Security","Car Dealerships"],"lifecycle":[{"event":"open","at":"2026-10-20T03:08:03Z"}],"visa":[],"liveness":{"score":7,"band":"cold","label":"Long shot","p_open":1,"p_active":0.246,"p_room":0.28,"age_days":87,"expected_fill_days":19,"reasons":["conf:2","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-31T05:58:55Z"},"pay":{"stated_usd_annual":120900,"is_top_pay":false},"html_url":"https://alion.io/job/carmax-engineer-ii-cybersecurity-application-security","json_url":"https://alion.io/job/carmax-engineer-ii-cybersecurity-application-security.json","meta":{"generated_at":"2026-10-31T18:13:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28423,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1759292},"rest":"https://alion.io/mcp/rest/get_company?id=1759292"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcarmax-engineer-ii-cybersecurity-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcarmax-engineer-ii-cybersecurity-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcarmax-engineer-ii-cybersecurity-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/carmax-engineer-ii-cybersecurity-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcarmax-engineer-ii-cybersecurity-application-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2892238}},{"tool":"search_jobs","arguments":{"company":"carmax.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2892238},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}