Sr. Analyst, Cybersecurity, Third Party Risk Management (TPRM)

CarMax • Richmond, VA

1d • $102,900 - $154,400 • Hybrid

About The Position

We are looking for a Senior Analyst, Information Risk Management to lead, execute and enhance our Third-Party Risk Management program as part of a growing team in a fast-paced company that is leveraging technology to provide innovative methods to improve the car buying experience. The Senior Analyst, Information Risk Management is an experienced, senior Technology Information Risk Analyst with experience in the areas highlighted below. This is a unique opportunity to join a Fortune 200 company and national brand to leverage your expertise and influence to shape a growing Information Risk Management Program motivated to disrupt current process with new technology. This role is an integral individual contributor within the CarMax Cybersecurity Organization, leading the enterprise program responsible for identifying, assessing, monitoring, reporting, and ultimately reducing potential cybersecurity risks introduced by vendors, service providers, contractors, technology partners, SaaS platforms, cloud providers, managed service providers, and emerging technologies.

Requirements

• Bachelor's degree in Business / Computer Science / Information Systems with IT audit, risk or compliance experience or equivalent military experience preferred.
• Relevant industry certifications such as CRISC, CTPRP, CTPRA, CRVPM, CISSP preferred.
• Experience executing third party risk management programs at an organizational level, completing risk assessments for partners, technologies and business scenarios.
• Proficiency in assessing
• Detail oriented – Possess a keen eye for detail and accuracy in all operations. Leverage defined, repeatable methods for managing work and communicating progress and priority.
• Communication – Excellent verbal and written communication skills, with the ability to structure and deliver clear, accurate messaging. Ability to create and present concepts to various audiences, facilitate discussion and reach consensus.
• Analytical approach – Demonstrated strength in complex data analysis and proficiency apply a structured, risk-based set of standards and processes to deliver operational excellence in a critical business function. Experience leveraging common TPRM frameworks and risk management concepts to effectively assess.
• Innovation & Strategic Thinking – Ability to assess situations critically to determine optimal path forward in support of business and risk objectives, while continually seeking opportunities to strategically improve the program.
• Customer Focus – Ability to provide exceptional customer service for our internal partners, with a mindset for understanding their need and consistently finding ways to exceed expectation.
• Collaboration – Strong emphasis on effective relationship building and partnership. Excellent communication skills to include but not limited to verbal and written communication; delivering organized presentations; able to tailor message to the audience; and facilitate group discussions with diplomacy and seek diverse opinions.
• Knowledge of information security, risk management industry frameworks and standards such as NIST CSF, NIST RMF, ISO 31000, COSO ERM
• 5+ years working experience with enterprise and technology risk management programs, privacy, data security and control issues with technologies.
• Experience leveraging and optimizing enterprise-class GRC platforms and continuous monitoring tools such as Optro, OneTrust, Archer, BlackKite, BitSight, etc. to execute a third-party risk management program.

Nice To Haves

• Bachelor's degree in Business / Computer Science / Information Systems with IT audit, risk or compliance experience or equivalent military experience preferred.
• Relevant industry certifications such as CRISC, CTPRP, CTPRA, CRVPM, CISSP preferred.

Responsibilities

• Own, execute and optimize the CarMax Third Party Risk Management (TPRM) program as an internal subject matter expert.
• Own and drive the TPRM program strategy and multi-year roadmap. Set maturity goals, priorities, and milestones aligned with enterprise risk appetite, regulatory expectations, and business objectives.
• Drive continual improvement in the TPRM program. Identify opportunities to increase the effectiveness and velocity of TPRM processes including platform workflows, questionnaires, risk scoring, notifications, and integrations with procurement and other enterprise systems. Leverage AI tools and capabilities to enhance data analysis and streamline manual processes.
• Maintain the guiding TPRM policies, standards, and procedures. This includes risk and criticality scoring models and category-driven assessment methodologies. Ensure these remain current and effective as regulatory requirements and business needs dictate.
• Manage intake, prioritization and assessment of prospective and existing third parties. Review and assess intake information, determine inherent risk and criticality and scope due diligence as part of the overall procurement and sourcing processes.
• Partner with internal and external teams to conduct third-party risk reviews. Coordinate assessments across domains such as information security, data privacy, resilience, compliance, and operational risk, and route deeper reviews to domain specialists as needed.
• Partner with Legal, Procurement, relationship owners and vendor teams to ensure that appropriate, risk-focused contractual terms and conditions are included to protect CarMax and our customers. Manage the set of standard security provisions covering security, privacy, resilience and response.
• Facilitate formal risk acceptances and exceptions with the appropriate business and risk leaders and track them to resolution where needed.
• Perform ongoing monitoring and periodic reassessments on a risk-based cadence. Use security ratings services, adverse media and sanctions screening, financial health indicators, and changes in services or data access.
• Manage third-party data in the centralized GRC platform, ensuring high data quality for vendor records (inventory, supporting detail, ratings, assessments, findings, and documents) so they are complete, accurate, and current.
• Prepare and deliver regular program updates and operational metrics to Information Security leadership, risk committees, and executive stakeholders.

Benefits

• Paid sick time
• Vacation time
• Holiday time
• Floating holiday
• Holiday Premium Pay
• Paid time away with no specified limit as needed for sick, vacation, bereavement, jury duty, holidays, floating holiday, etc. subject to manager approval.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior