Analyst II, Cybersecurity- Information Risk Management

We are looking for an Analyst II, Information Risk Management to maintain and enhance the Information Risk Management posture of an innovative and fast paced company that is leveraging technology to provide innovative methods to improve the car buying experience.

The Analyst II, Information Risk Management is an integral individual contributor role within the Car Max Information Security Organization, focused on planning and executing critical risk and privacy operations and initiatives for the company to ensure continuous privacy operations, modernize control methodologies through automation and artificial intelligence, and streamline privacy assessments to improve the program’s efficiency and effectiveness.

This is a unique opportunity to work at a Fortune 200 company and national brand to expand your skills and influence a growing Technology Program. This role will partner across Business and Technology teams to design, implement and manage privacy operations practices ensuring Car Max effectively assesses and mitigates risk to company and customer data. The successful candidate will leverage strengths in privacy operations execution and drive continuous improvement through process optimization, automation and AI for streamlined efficiency.

The Analyst II, Information Risk Management – Privacy will focus primarily on facilitating and supporting regulatory and privacy operations for the company to ensure an effective and compliant posture for Car Max and our customers. This role serves as the conduit between the business community, Privacy core team, technology, and the application development teams. The Analyst II – Privacy manages the intake, analysis and completion of privacy requests and facilitates all operational aspects of the privacy lifecycle, including:

• Privacy Request Support – Coordinate with multiple technology teams to capture, assess and process data subject access requests (DSAR) timely and accurately.
• Privacy Operations Management – Use service delivery principles to implement, execute and measure the program and related services consistently and effectively. Prepare and deliver regular program updates with KPIs that illustrate volumes, trends and risk areas to stakeholders. Maintain appropriate work management practices and backlogs to meet or exceed SLAs.
• Process Improvement – Identify and implement opportunities to simplify and strengthen our privacy risk management processes and capabilities using process analysis, automation and AI where applicable.
• Privacy Technology Administration – Utilize standalone and integrated platforms in daily operations and perform system improvements and administration.
• Privacy Impact Assessment – Facilitate ongoing data privacy assessments of internal systems to effectively manage data sensitivity risk across the enterprise.
• Policy Governance Lifecycle Management – Own and manage the technology and information security focused guidance to ensure all policies, procedures, standards and job aids remain current, published and available for our associates.
• Knowledge Management – Document and maintain clear, effective reference documentation (playbooks, processes, job aids, technical diagrams) as an internal knowledgebase and for ease of customer experience.
• Projects, as defined – Participate in related strategic and tactical projects as necessary to mature the privacy operations function.
• As an integral member of the team, exhibiting ownership, follow-through, initiative, awareness and effective communication with peers and management and ability to speak to details of privacy operations.
• Maintain a strong knowledge base and awareness of industry and technological trends, external regulations for new or changed requirements within privacy and technology for core processes (e.g. NiST, PCI, ITIL, data privacy etc.).

• Bachelor’s degree in business / computer science / information systems (or related)
• 2+ years working experience in privacy, technology compliance, IT Audit, cybersecurity, or related experience.
• One or more of the following privacy-focused certifications such as: CIPP,…