8901 - Corp Office West Crk - 12800 Tuckahoe Creek Parkway, Richmond, Virginia, 23238
CarMax, the way your career should be!
CarMax, the way your career should be!
We are looking for a Senior Analyst, Information Risk Management to lead, execute and enhance our Third-Party Risk Management program as part of a growing team in a fast-paced company that is leveraging technology to provide innovative methods to improve the car buying experience.
The Senior Analyst, Information Risk Management is an experienced, senior Technology Information Risk Analyst with experience in the areas highlighted below. This is a unique opportunity to join a Fortune 200 company and national brand to leverage your expertise and influence to shape a growing Information Risk Management Program motivated to disrupt current process with new technology.
This role is an integral individual contributor within the CarMax Cybersecurity Organization, leading the enterprise program responsible for identifying, assessing, monitoring, reporting, and ultimately reducing potential cybersecurity risks introduced by vendors, service providers, contractors, technology partners, SaaS platforms, cloud providers, managed service providers, and emerging technologies.
What you will do – Essential Responsibilities:
As a key member of a high performing information risk management team, own, execute and optimize the CarMax Third Party Risk Management (TPRM) program as an internal subject matter expert.
Own and drive the TPRM program strategy and multi-year roadmap. Set maturity goals, priorities, and milestones aligned with enterprise risk appetite, regulatory expectations, and business objectives.
Drive continual improvement in the TPRM program. Identify opportunities to increase the effectiveness and velocity of TPRM processes including platform workflows, questionnaires, risk scoring, notifications, and integrations with procurement and other enterprise systems. Leverage AI tools and capabilities to enhance data analysis and streamline manual processes.
Maintain the guiding TPRM policies, standards, and procedures. This includes risk and criticality scoring models and category-driven assessment methodologies. Ensure these remain current and effective as regulatory requirements and business needs dictate.
Manage intake, prioritization and assessment of prospective and existing third parties. Review and assess intake information, determine inherent risk and criticality and scope due diligence as part of the overall procurement and sourcing processes.
Partner with internal and external teams to conduct third-party risk reviews. Coordinate assessments across domains such as information security, data privacy, resilience, compliance, and operational risk, and route deeper reviews to domain specialists as needed.
Partner with Legal, Procurement, relationship owners and vendor teams to ensure that appropriate, risk-focused contractual terms and conditions are included to protect CarMax and our customers. Manage the set of standard security provisions covering security, privacy, resilience and response.
Facilitate formal risk acceptances and exceptions with the appropriate business and risk leaders and track them to resolution where needed.
Perform ongoing monitoring and periodic reassessments on a risk-based cadence. Use security ratings services, adverse media and sanctions screening, financial health indicators, and changes in services or data access.
Manage third-party data in the centralized GRC platform, ensuring high data quality for vendor records (inventory, supporting detail, ratings, assessments, findings, and documents) so they are complete, accurate, and current.
Prepare and deliver regular program updates and operational metrics to Information Security leadership, risk committees, and executive stakeholders.
Education and/or Experience:
Bachelor's degree in Business / Computer Science / Information Systems with IT audit, risk or compliance experience or equivalent…