CarMax

4 weeks ago

Sr. Analyst, Technology Compliance

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 6 hours agoStatus: Live

Job Summary

Serve as a senior subject matter expert to strengthen the IT control environment by designing, evaluating, and testing internal technology compliance controls. Monitor regulatory and technology changes, lead control reviews for new technologies and business areas, identify gaps between policy and practice, and recommend remediation. Partner with technology, product, and compliance teams to maintain enterprise General IT Controls, support audits, and communicate findings, risks, and improvement plans.

Location: Richmond

Workplace: Onsite

Employment Type: Full time

Job Function: Legal, Risk & Compliance

Seniority: Mid level

Key Responsibilities

•Develop and maintain a technology compliance framework, including validation, classification, and control testing across IT domains.
•Design, implement, and maintain enterprise-wide General IT Controls (GITCs) aligned with regulatory requirements (e.g., PCI DSS, SOX, HIPAA, data privacy).
•Conduct compliance assessments and pre-implementation reviews to ensure controls are designed, implemented, and documented.
•Facilitate internal and external audits by communicating findings, recommendations, and remediation plans in a timely manner.
•Monitor information security/control effectiveness, analyze control weaknesses, and recommend enhancements; lead remediation and design review meetings.

Pay and Benefits

Salary: 99,200 - 148,800 annually

Equity and Bonus:Equity

Perks:Paid Leave

Key Requirements

•Bachelor’s degree (or equivalent experience) with solid IT audit or compliance experience.
•5+ years’ experience with enterprise technology compliance management programs, auditing, controls testing, and ITGC/PCI assessments.
•Familiarity with technology compliance frameworks/standards including NIST, OWASP, SANS, ISO-27001/2, and Cobit.
•Industry certifications required: CISA and/or CISSP (desired: CRISC, CIA, CISM, PCI).
•Strong communication skills to present findings and facilitate group discussions, plus strong analytical and organizational skills.

Experience:5+ years

Education:Bachelor's

Skills:CommunicationAnalytical skillsProblem-solvingOrganizational skillsAttention to detail

Certifications:CISACISSPCRISCCIACISMPCI

Tech Stack:PCI DSSHIPAASOXNISTOWASPSANSISO-27001/2CobitITILGITCsITGCData privacyCOBITGeneral IT ControlsGeneral IT Controls (GITCs)

Eligibility

Work Authorization:Authorization required. Sponsorship not provided.

Company Brief

CarMax

Industry: Automotive

Website

Loading job details...

Preparing the role view and application actions.

CarMax

4 weeks ago

Sr. Analyst, Technology Compliance

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 6 hours agoStatus: Live

Job Summary

Location: Richmond

Workplace: Onsite

Employment Type: Full time

Job Function: Legal, Risk & Compliance

Seniority: Mid level

Key Responsibilities

•Develop and maintain a technology compliance framework, including validation, classification, and control testing across IT domains.
•Design, implement, and maintain enterprise-wide General IT Controls (GITCs) aligned with regulatory requirements (e.g., PCI DSS, SOX, HIPAA, data privacy).
•Conduct compliance assessments and pre-implementation reviews to ensure controls are designed, implemented, and documented.
•Facilitate internal and external audits by communicating findings, recommendations, and remediation plans in a timely manner.
•Monitor information security/control effectiveness, analyze control weaknesses, and recommend enhancements; lead remediation and design review meetings.

Pay and Benefits

Salary: 99,200 - 148,800 annually

Equity and Bonus:Equity

Perks:Paid Leave

Key Requirements

•Bachelor’s degree (or equivalent experience) with solid IT audit or compliance experience.
•5+ years’ experience with enterprise technology compliance management programs, auditing, controls testing, and ITGC/PCI assessments.
•Familiarity with technology compliance frameworks/standards including NIST, OWASP, SANS, ISO-27001/2, and Cobit.
•Industry certifications required: CISA and/or CISSP (desired: CRISC, CIA, CISM, PCI).
•Strong communication skills to present findings and facilitate group discussions, plus strong analytical and organizational skills.

Experience:5+ years

Education:Bachelor's

Skills:CommunicationAnalytical skillsProblem-solvingOrganizational skillsAttention to detail

Certifications:CISACISSPCRISCCIACISMPCI

Tech Stack:PCI DSSHIPAASOXNISTOWASPSANSISO-27001/2CobitITILGITCsITGCData privacyCOBITGeneral IT ControlsGeneral IT Controls (GITCs)

Eligibility

Work Authorization:Authorization required. Sponsorship not provided.

Company Brief

CarMax

Industry: Automotive

Website