Sr. Analyst, Cybersecurity, Third Party Risk Management (TPRM)

CarMax, the way your career should be!

CarMax, the way your career should be!

We are looking for a Senior Analyst, Information Risk Management to lead, execute and enhance our Third-Party Risk Management program as part of a growing team in a fast-paced company that is leveraging technology to provide innovative methods to improve the car buying experience.

The Senior Analyst, Information Risk Management is an experienced, senior Technology Information Risk Analyst with experience in the areas highlighted below. This is a unique opportunity to join a Fortune 200 company and national brand to leverage your expertise and influence to shape a growing Information Risk Management Program motivated to disrupt current process with new technology.

This role is an integral individual contributor within the CarMax Cybersecurity Organization, leading the enterprise program responsible for identifying, assessing, monitoring, reporting, and ultimately reducing potential cybersecurity risks introduced by vendors, service providers, contractors, technology partners, SaaS platforms, cloud providers, managed service providers, and emerging technologies.

What you will do - Essential Responsibilities:

• As a key member of a high performing information risk management team, own, execute and optimize the CarMax Third Party Risk Management (TPRM) program as an internal subject matter expert.
• Own and drive the TPRM program strategy and multi-year roadmap. Set maturity goals, priorities, and milestones aligned with enterprise risk appetite, regulatory expectations, and business objectives.
• Drive continual improvement in the TPRM program. Identify opportunities to increase the effectiveness and velocity of TPRM processes including platform workflows, questionnaires, risk scoring, notifications, and integrations with procurement and other enterprise systems. Leverage AI tools and capabilities to enhance data analysis and streamline manual processes.
• Maintain the guiding TPRM policies, standards, and procedures. This includes risk and criticality scoring models and category-driven assessment methodologies. Ensure these remain current and effective as regulatory requirements and business needs dictate.
• Manage intake, prioritization and assessment of prospective and existing third parties. Review and assess intake information, determine inherent risk and criticality and scope due diligence as part of the overall procurement and sourcing processes.
• Partner with internal and external teams to conduct third-party risk reviews. Coordinate assessments across domains such as information security, data privacy, resilience, compliance, and operational risk, and route deeper reviews to domain specialists as needed.
• Partner with Legal, Procurement, relationship owners and vendor teams to ensure that appropriate, risk-focused contractual terms and conditions are included to protect CarMax and our customers. Manage the set of standard security provisions covering security, privacy, resilience and response.
• Facilitate formal risk acceptances and exceptions with the appropriate business and risk leaders and track them to resolution where needed.
• Perform ongoing monitoring and periodic reassessments on a risk-based cadence. Use security ratings services, adverse media and sanctions screening, financial health indicators, and changes in services or data access.
• Manage third-party data in the centralized GRC platform, ensuring high data quality for vendor records (inventory, supporting detail, ratings, assessments, findings, and documents) so they are complete, accurate, and current.
• Prepare and deliver regular program updates and operational metrics to Information Security leadership, risk committees, and executive stakeholders.

Education and/or Experience:

• Bachelor's degree in Business / Computer Science / Information Systems with IT audit, risk or compliance experience or equivalent military experience preferred.
• Relevant industry certifications such as CRISC, CTPRP, CTPRA, CRVPM, CISSP preferred.
• Experience executing third party risk management programs at an organizational level, completing risk assessments for partners, technologies and business scenarios. Proficiency in assessing
• Detail oriented - Possess a keen eye for detail and accuracy in all operations. Leverage defined, repeatable methods for managing work and communicating progress and priority.
• Communication - Excellent verbal and written communication skills, with the ability to structure and deliver clear, accurate messaging. Ability to create and present concepts to various audiences, facilitate discussion and reach consensus.
• Analytical approach - Demonstrated strength in complex data analysis and proficiency apply a structured, risk-based set of standards and processes to deliver operational excellence in a critical business function. Experience leveraging common TPRM frameworks and risk management concepts to effectively assess.
• Innovation & Strategic Thinking - Ability to assess situations critically to determine optimal path forward in support of business and risk objectives, while continually seeking opportunities to strategically improve the program.
• Customer Focus - Ability to provide exceptional customer service for our internal partners, with a mindset for understanding their need and consistently finding ways to exceed expectation.
• Collaboration - Strong emphasis on effective relationship building and partnership. Excellent communication skills to include but not limited to verbal and written communication; delivering organized presentations; able to tailor message to the audience; and facilitate group discussions with diplomacy and seek diverse opinions.
• Knowledge of information security, risk management industry frameworks and standards such as NIST CSF, NIST RMF, ISO 31000, COSO ERM
• 5+ years working experience with enterprise and technology risk management programs, privacy, data security and control issues with technologies.
• Experience leveraging and optimizing enterprise-class GRC platforms and continuous monitoring tools such as Optro, OneTrust, Archer, BlackKite, BitSight, etc. to execute a third-party risk management program.

Work Location and Arrangement: This role will be based out of the Richmond, VA Home Office. Associates based in Richmond work onsite 4 days per week.

Work Authorization: Applicants must be currently authorized to work in the United States on a full-time basis. Sponsorship will not be considered for this specific role.

About CarMax

CarMax disrupted the auto industry by delivering the honest, transparent and high-integrity experience customers want and deserve. This innovative thinking around the way cars are bought and sold has helped us become the nation’s largest retailer of used cars, with over 200 locations nationwide.

Our amazing team of more than 25,000 associates work together to deliver iconic customer experiences. Along the way, we help every associate grow their career and achieve their best, at work and in their community. We are recognized for our commitment to training and diversity and are one of the FORTUNE 100 Best Companies to Work For®.

Our Commitment to Diversity and Inclusion:

CarMax is committed to bringing together people from different backgrounds and perspectives, providing employees with a safe, welcoming, and inclusive work environment.

CarMax is an equal opportunity employer, and all qualified candidates will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity, gender expression, genetic information, national origin, protected veteran status, disability status, and any other characteristics protected by law.

The annual salary for this position is:

May be eligible for bonus and equity.

Benefits:

Except as otherwise required by state law, CarMax Associates are entitled to the following paid sick, vacation, and holiday time.

Associates that are considered full-time hourly or commission/incentive eligible:

• To earn up to 48 hours of sick time per year accrued on a per pay period basis and between 80 hours and 200 hours per year of vacation time after a 90 day waiting period depending on years of continuous service with the Company.
• For 8 hours of pay for each of a total of 6 paid scheduled holidays per year plus 1 floating holiday. If such an Associate does work on a scheduled holiday due to business need, they are eligible for Holiday Premium Pay.

Associates considered full-time salaried are entitled to paid time away with no specified limit as needed for sick, vacation, bereavement, jury duty, holidays, floating holiday, etc. subject to manager approval.

For more details about benefits, please visit our CarMax Benefits website.

Upon an applicant's request, CarMax will consider reasonable accommodation to complete the CarMax Job Application.