Engineer II, Cybersecurity, Application Security

CarMax Enterprise Services, LLC is seeking a Cybersecurity Engineer II focused on Application Security to join the Richmond, Virginia team on site. The role centers on implementing and enhancing security solutions across static and dynamic analysis, API security, and container security, while providing technical guidance on security projects and supporting on-call coverage for incident response.

Responsibilities

• Implement, develop, operate, and improve Cybersecurity solutions used to advance Application Security at CarMax, including static and dynamic analysis, API security, and container security.
• Provide functional and technical guidance on projects with application security implications for the company.
• Learn and understand the full portfolio of Cybersecurity capabilities at CarMax and how they collaborate to secure the enterprise.
• Independently drive tasks and projects to successful completion through effective time management, stakeholder interaction, and cross-functional collaboration.
• Effectively triage support issues and respond with appropriate urgency.
• Participate in a 24x7 on-call weekly rotation as scheduled, with the ability to perform after-hours support as needed.
• Current rotation is about 3 weeks per year.

Requirements

• Strong fundamentals in general cybersecurity concepts with an interest in applying them to Application Security.
• Functional understanding of at least one coding or scripting language, such as PowerShell, Python, .NET, JavaScript, or C#.
• Excellent analytical, troubleshooting, and problem-solving skills, able to perform under pressure.
• Strong organization and time-management abilities.
• Excellent communication skills, including verbal and written, with the ability to tailor messages to different audiences and facilitate group discussions with diplomacy.
• Ability to estimate efforts and assess impact to complete requested tasks or projects.

Technologies

• PowerShell
• Python
• .Net
• JavaScript
• C#
• GitHub
• Azure DevOps
• TeamCity
• Azure
• AWS
• GCP
• Kubernetes

Benefits

• Paid sick time
• Paid vacation time
• Paid holidays (6 per year) plus 1 floating holiday
• Holiday premium pay
• Paid time away for full-time salaried employees with no specified limit for sick, vacation, bereavement, jury duty, holidays, floating holiday, etc., subject to manager approval

Work Location and Arrangement

Location: Richmond, VA (onsite) at the CarMax Home Office in West Creek. Associates will work onsite four days per week.

Work Authorization

Eligibility: Applicants must be currently authorized to work in the United States on a full-time basis.

Compensation

Salary: USD 80,600 - 120,900 per year.

Preferred Qualifications

• Functional proficiency with at least one coding or scripting language
• Experience performing dynamic application security testing (DAST) using open source and commercial tools
• Experience performing static security code analysis (SAST) and providing actionable recommendations to stakeholders
• Experience integrating security into the container lifecycle, including image assurance, Kubernetes posture management, secrets management, and runtime threat detection