Cybersecurity Architect

Cybersecurity Architect

Position Overview

As a Cybersecurity Architect on CarMax’s Security Architecture Team, you will serve as a Home Office–based cybersecurity leader and trusted advisor representing the CISO and enterprise cybersecurity best practices across all engagements. This role plays a critical part in protecting the confidentiality, integrity, and availability of customer, associate, vendor, and business information while enabling secure innovation at scale.

You will partner closely with Technology and Business teams to provide cybersecurity advisory services across system design, engineering, and implementation. Operating with a consulting mindset, you will influence enterprise decisions, guide architectural direction, and help mature CarMax’s cybersecurity posture to stay ahead of an evolving threat landscape.

Primary Duties and Responsibilities

• Provide hands‑on cybersecurity architecture and engineering expertise supporting compliance‑driven and enterprise initiatives
• Lead and document cybersecurity architecture decisions, standards, and design artifacts
• Provide cybersecurity leadership for new technologies, vendor evaluations, and proofs of concept
• Lead competitive selection and implementation of cybersecurity tools and platforms
• Embed cybersecurity controls throughout the full system development lifecycle across cloud‑first and on‑prem environments
• Perform cybersecurity assessments using industry standards such as NIST CSF, OWASP, and ISO
• Identify risks, articulate mitigation strategies, and clearly communicate alternatives and tradeoffs

Team Development

• Review and advise on program and architecture documentation produced by team members
• Partner with Technology, Product, and Architecture teams to deliver shared outcomes
• Maintain tight collaboration with Enterprise Architecture
• Support efforts to attract, develop, and retain highly skilled cybersecurity talent

Leadership

• Lead cybersecurity requirements for large, enterprise‑wide transformation initiatives
• Mentor associates on cybersecurity practices, standards, and concepts
• Influence cybersecurity direction through collaboration and consensus building
• Communicate architectural standards and explain the “why” behind cybersecurity decisions
• Drive successful delivery of initiatives aligned to enterprise architecture objectives and key results

Required Qualifications

• Ability to design complex systems across infrastructure, application, network, mobile, and cloud domains with cybersecurity considerations
• Strong understanding of the full operational lifecycle and ownership of architectural design
• Experience analyzing business and technical requirements, risks, costs, and opportunities
• Ability to mentor others in producing engineering and architecture artifacts
• Experience estimating effort and supporting cybersecurity budget forecasting
• Broad understanding of enterprise business processes
• Strong partnership with Enterprise Architecture

Preferred Qualifications

• Experience with cloud security in Azure or AWS across SaaS and IaaS models
• Experience defining cybersecurity user stories and technical specifications
• Proven ability to design and implement cybersecurity solutions across enterprise environments
• Experience modernizing systems, designing reusable components, and reducing redundancy
• Architectural experience supporting 24x7 production and non‑production environments
• Experience influencing cybersecurity tool selection and enterprise implementations
• Knowledge of emerging cybersecurity technologies and trends

Education and/or Experience

• Approximately 10 years of technology experience with a focus on cybersecurity or application security
• Bachelor’s degree in Computer Science, Cybersecurity, or related field, or equivalent experience
• Experience across a broad range of technology systems
• In‑depth knowledge of frameworks and standards including NIST, OWASP, ISO‑27001/2, SANS, COBIT, ITIL, and MITRE ATT&CK
• Knowledge of cybersecurity best practices such as PCI, ITGCs, HIPAA, and Privacy
• Security certifications such as CISSP, CISM, or Security+ preferred

Work Location and Arrangement:

This role will be based out of the CarMax Home Office in Richmond, VA and Associates will work onsite 4 days per week.

Work Authorization:

Applicants must be currently authorized to work in the United States on a full‑time basis. Sponsorship will not be considered for this specific role.

About CarMax

CarMax disrupted the auto industry by delivering the honest, transparent and high‑integrity experience customers want and deserve. This innovative thinking around the way cars are bought and sold has helped us become the nation’s largest retailer of used cars, with over 250 locations nationwide.

Our amazing team of more than 25,000 associates work together to deliver iconic customer experiences. Along the way, we help every associate grow their career and achieve their best, at work and in their community.  We are recognized for our commitment to training and are one of the FORTUNE 100 Best Companies to Work For®.