Sr. Analyst, Cybersecurity, Third Party Risk Management (TPRM)

Senior Analyst, Information Risk Management

We are looking for a Senior Analyst, Information Risk Management to lead, execute and enhance our Third-Party Risk Management program as part of a growing team in a fast-paced company that is leveraging technology to provide innovative methods to improve the car buying experience.

This role is an integral individual contributor within the CarMax Cybersecurity Organization, leading the enterprise program responsible for identifying, assessing, monitoring, reporting, and ultimately reducing potential cybersecurity risks introduced by vendors, service providers, contractors, technology partners, SaaS platforms, cloud providers, managed service providers, and emerging technologies.

What you will do Essential Responsibilities:

• As a key member of a high performing information risk management team, own, execute and optimize the CarMax Third Party Risk Management (TPRM) program as an internal subject matter expert.
• Own and drive the TPRM program strategy and multi-year roadmap. Set maturity goals, priorities, and milestones aligned with enterprise risk appetite, regulatory expectations, and business objectives.
• Drive continual improvement in the TPRM program. Identify opportunities to increase the effectiveness and velocity of TPRM processes including platform workflows, questionnaires, risk scoring, notifications, and integrations with procurement and other enterprise systems. Leverage AI tools and capabilities to enhance data analysis and streamline manual processes.
• Maintain the guiding TPRM policies, standards, and procedures. This includes risk and criticality scoring models and category-driven assessment methodologies. Ensure these remain current and effective as regulatory requirements and business needs dictate.
• Manage intake, prioritization and assessment of prospective and existing third parties. Review and assess intake information, determine inherent risk and criticality and scope due diligence as part of the overall procurement and sourcing processes.
• Partner with internal and external teams to conduct third-party risk reviews. Coordinate assessments across domains such as information security, data privacy, resilience, compliance, and operational risk, and route deeper reviews to domain specialists as needed.
• Partner with Legal, Procurement, relationship owners and vendor teams to ensure that appropriate, risk-focused contractual terms and conditions are included to protect CarMax and our customers. Manage the set of standard security provisions covering security, privacy, resilience and response.
• Facilitate formal risk acceptances and exceptions with the appropriate business and risk leaders and track them to resolution where needed.
• Perform ongoing monitoring and periodic reassessments on a risk-based cadence. Use security ratings services, adverse media and sanctions screening, financial health indicators, and changes in services or data access.
• Manage third-party data in the centralized GRC platform, ensuring high data quality for vendor records (inventory, supporting detail, ratings, assessments, findings, and documents) so they are complete, accurate, and current.
• Prepare and deliver regular program updates and operational metrics to Information Security leadership, risk committees, and executive stakeholders.

Education and/or Experience:

• Bachelor's degree in Business / Computer Science / Information Systems with IT audit, risk or compliance experience or equivalent military experience preferred.
• Relevant industry certifications such as CRISC, CTPRP, CTPRA, CRVPM, CISSP preferred.
• Experience executing third party risk management programs at an organizational level, completing risk assessments for partners, technologies and business scenarios. Proficiency in assessing
• Detail oriented Possess a keen eye for detail and accuracy in all operations. Leverage defined, repeatable methods for managing work and communicating progress and priority.
• Communication Excellent verbal and written communication skills, with the ability to structure and deliver clear, accurate messaging. Ability to create and present concepts to various audiences, facilitate discussion and reach consensus.
• Analytical approach Demonstrated strength in complex data analysis and proficiency apply a structured, risk-based set of standards and processes to deliver operational excellence in a critical business function. Experience leveraging common TPRM frameworks and risk management concepts to effectively assess.
• Innovation & Strategic Thinking Ability to assess situations critically to determine optimal path forward in support of business and risk objectives, while continually seeking opportunities to strategically improve the program.
• Customer Focus Ability to provide exceptional customer service for our internal partners, with a mindset for understanding their need and consistently finding ways to exceed expectation.
• Collaboration Strong emphasis on effective relationship building and partnership. Excellent communication skills to include but not limited to verbal and written communication; delivering organized presentations; able to tailor message to the audience; and facilitate group discussions with diplomacy and seek diverse opinions.
• Knowledge of information security, risk management industry frameworks and standards such as NIST CSF, NIST RMF, ISO 31000, COSO ERM
• 5+ years working experience with enterprise and technology risk management programs, privacy, data security and control issues with technologies.
• Experience leveraging and optimizing enterprise-class GRC platforms and continuous monitoring tools such as Optro, OneTrust, Archer, BlackKite, BitSight, etc. to execute a third-party risk management program.

Work Location and Arrangement: This role will be based out of the Richmond, VA Home Office. Associates based in Richmond work onsite 4 days per week.

Work Authorization: Applicants must be currently authorized to work in the United States on a full-time basis. Sponsorship will not be considered for this specific role.