Cybersecurity Architect
Position Overview
As a Cybersecurity Architect on CarMax’s Security Architecture Team, you will serve as a Home Office–based cybersecurity leader and trusted advisor representing the CISO and enterprise cybersecurity best practices across all engagements. This role plays a critical part in protecting the confidentiality, integrity, and availability of customer, associate, vendor, and business information while enabling secure innovation at scale.
You will partner closely with Technology and Business teams to provide cybersecurity advisory services across system design, engineering, and implementation. Operating with a consulting mindset, you will influence enterprise decisions, guide architectural direction, and help mature CarMax’s cybersecurity posture to stay ahead of an evolving threat landscape.
Primary Duties and Responsibilities
- Provide hands‑on cybersecurity architecture and engineering expertise supporting compliance‑driven and enterprise initiatives
- Lead and document cybersecurity architecture decisions, standards, and design artifacts
- Provide cybersecurity leadership for new technologies, vendor evaluations, and proofs of concept
- Lead competitive selection and implementation of cybersecurity tools and platforms
- Embed cybersecurity controls throughout the full system development lifecycle across cloud‑first and on‑prem environments
- Perform cybersecurity assessments using industry standards such as NIST CSF, OWASP, and ISO
- Identify risks, articulate mitigation strategies, and clearly communicate alternatives and tradeoffs
Team Development
- Review and advise on program and architecture documentation produced by team members
- Partner with Technology, Product, and Architecture teams to deliver shared outcomes
- Maintain tight collaboration with Enterprise Architecture
- Support efforts to attract, develop, and retain highly skilled cybersecurity talent
Leadership
- Lead cybersecurity requirements for large, enterprise‑wide transformation initiatives
- Mentor associates on cybersecurity practices, standards, and concepts
- Influence cybersecurity direction through collaboration and consensus building
- Communicate architectural standards and explain the “why” behind cybersecurity decisions
- Drive successful delivery of initiatives aligned to enterprise architecture objectives and key results
Required Qualifications
- Ability to design complex systems across infrastructure, application, network, mobile, and cloud domains with cybersecurity considerations
- Strong understanding of the full operational lifecycle and ownership of architectural design
- Experience analyzing business and technical requirements, risks, costs, and opportunities
- Ability to mentor others in producing engineering and architecture artifacts
- Experience estimating effort and supporting cybersecurity budget forecasting
- Broad understanding of enterprise business processes
- Strong partnership with Enterprise Architecture
Preferred Qualifications
- Experience with cloud security in Azure or AWS across SaaS and IaaS models
- Experience defining cybersecurity user stories and technical specifications
- Proven ability to design and implement cybersecurity solutions across enterprise environments
- Experience modernizing systems, designing reusable components, and reducing redundancy
- Architectural experience supporting 24x7 production and non‑production environments
- Experience influencing cybersecurity tool selection and enterprise implementations
- Knowledge of emerging cybersecurity technologies and trends
Education and/or Experience
- Approximately 10 years of technology experience with a focus on cybersecurity or application security
- Bachelor’s degree in Computer Science, Cybersecurity, or related field, or equivalent experience
- Experience across a broad range of technology systems
- In‑depth knowledge of frameworks and standards including NIST, OWASP, ISO‑27001/2, SANS, COBIT, ITIL, and MITRE ATT&CK
- Knowledge of cybersecurity best practices such as PCI, ITGCs, HIPAA, and Privacy
- Security certifications such as CISSP, CISM, or Security+ preferred
Work Location and Arrangement:
This role will be based out of the CarMax Home Office in Richmond, VA and Associates will work onsite 4 days per week.
Work Authorization:
Applicants must be currently authorized to work in the United States on a full‑time basis. Sponsorship will not be considered for this specific role.
About CarMax
CarMax disrupted the auto industry by delivering the honest, transparent and high‑integrity experience customers want and deserve. This innovative thinking around the way cars are bought and sold has helped us become the nation’s largest retailer of used cars, with over 250 locations nationwide.
Our amazing team of more than 25,000 associates work together to deliver iconic customer experiences. Along the way, we help every associate grow their career and achieve their best, at work and in their community. We are recognized for our commitment to training and are one of the FORTUNE 100 Best Companies to Work For®.
Upon an applicant's request, CarMax will consider reasonable accommodation to complete the CarMax Job Application.
Skills Required
- Approximately 10 years of technology experience with a focus on cybersecurity or application security
- Bachelor's degree in Computer Science, Cybersecurity, or related field, or equivalent experience
- In‑depth knowledge of frameworks and standards including NIST, OWASP, ISO‑27001/2, SANS, COBIT, ITIL, and MITRE ATT&CK
- Security certifications such as CISSP, CISM, or Security+
CarMax Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about CarMax and has not been reviewed or approved by CarMax.
-
Retirement Support — Retirement benefits appear robust, including a 401(k) with dollar-for-dollar matching up to the first 6% of base salary and immediate vesting. Stock purchase programs with a discount or match are positioned as an additional long-term wealth-building option.
-
Healthcare Strength — Health coverage is described as comprehensive, spanning medical, dental, vision, disability, and life insurance, with access beginning relatively early for eligible associates. Mental health resources and wellbeing programs are also present as part of the health offering.
-
Leave & Time Off Breadth — Time-off offerings are described as broad, including vacation, holidays, sick time, and paid leave related to new child placement or birth/adoption in addition to family medical leave options. The structure varies by role and tenure, but the overall menu is sizable.
CarMax Insights
What We Do
CarMax revolutionized the auto industry by delivering the honest, transparent and high-integrity car buying experience customers want and deserve. This disruptive thinking has helped us become the nation’s largest retailer of used cars with more than 200 stores nationwide. And thanks to our amazing team of nearly 25,000 associates, we have been recognized as one of the FORTUNE 100 Best Companies to Work For® - 16 years in a row! Committed to hiring people with strong values of integrity, transparency and respect, we offer unmatched training and support for associate career growth, and have been recognized as one of Training Magazine’s "Training Top 125" companies in America. We are also proud to be a best place to work for Veterans, and the #2 Best Workplace for Retail.
.png){kind=logo}
