Engineer II, Cybersecurity, Application Security

This role is a Cybersecurity Engineer II focused on Application Security with CarMax Enterprise Services, LLC in Richmond, VA on site, offering a salary range of USD 80,600 - 120,900 per year.

Responsibilities

• Design, implement, operate, and improve security solutions that advance application security, including static analysis, dynamic testing, API protection, and container security.
• Provide functional and technical guidance on projects with application security implications for the organization.
• Develop a deep understanding of the full portfolio of CarMax cybersecurity capabilities and how they interwork to fortify the enterprise.
• Independently drive tasks and projects to completion through effective time management, stakeholder engagement, and cross-functional collaboration.
• Efficiently triage security incidents and respond with appropriate urgency.
• Participate in a weekly 24x7 on-call rotation with potential after hours support as needed.
• Current on-call rotation is approximately three weeks per year.

Requirements

• Strong foundational knowledge of cybersecurity concepts with an interest in expanding expertise in Application Security.
• Proficiency in at least one coding or scripting language such as PowerShell, Python, .NET, JavaScript, or C#.
• Excellent analytical, troubleshooting, and problem-solving abilities, including performance under pressure.
• Strong organizational and time-management skills.
• Excellent communication skills, both verbal and written; ability to tailor messages to diverse audiences and facilitate discussions with diplomacy.
• Ability to estimate effort and impact for tasks and projects to enable realistic planning.
• Minimum 2 years of relevant cybersecurity experience.
• Bachelor’s degree in Computer Science, Engineering, Cybersecurity, or a related field.

Technologies

• PowerShell
• Python
• .NET
• JavaScript
• C#
• GitHub
• Azure DevOps
• TeamCity
• Azure
• AWS
• GCP
• Kubernetes

Benefits

• Paid sick time
• Paid vacation time
• Six holidays per year plus one floating holiday
• Holiday premium pay
• Paid time away for full-time salaried employees with no specified limit for sick, vacation, bereavement, jury duty, holidays, floating holiday, subject to manager approval

Work Location and Arrangement

This role is based at the CarMax Home Office in West Creek, Richmond, VA and requires onsite work four days per week.

Work Authorization

Applicants must be currently authorized to work in the United States on a full-time basis.

Preferred Qualifications

• Functional proficiency with at least one coding or scripting language.
• Experience performing dynamic application security testing (DAST) using open source and commercial tools.
• Experience performing static security code analysis (SAST) and providing actionable recommendations to stakeholders.
• Experience integrating security into the container lifecycle, including image assurance, Kubernetes posture management, secrets management, and runtime threat detection.