AppSec Engineer II: Secure Apps, DevSecOps & Cloud

CarMax Business Services; United States; On-site; USD 81,000 - 121,000; Full time

Benefits offered by this job

Bonus potential

Equity

Job summary

CarMax is seeking a Cybersecurity Engineer II to advance our Application Security program within a Fortune 100 Best Places to Work environment. You will join a collaborative team focused on solving complex security challenges and enabling product innovation through secure development practices.

The role requires strong cybersecurity fundamentals, scripting skills, and experience with cloud and DevSecOps tools. On-site work at West Creek, VA with a 24x7 on-call rotation is required.

Qualifications

• Bachelor’s degree in CS/Engineering/Cybersecurity or related field.
• CISSP preferred but not required.
• Experience in cybersecurity with DevSecOps practices.

Responsibilities

• Implement, develop, operate, and improve cybersecurity solutions for application security, including SAST/DAST and container security.
• Provide functional and technical expertise on projects with application security implications.
• Learn and understand CarMax's cybersecurity capabilities and how they interoperate.
• Independently drive tasks and projects to completion with effective time and cross-functional collaboration.
• Triage support issues and respond with appropriate urgency.
• Participate in a 24x7 on-call rotation (approx. 3 weeks per year).

Skills

Cybersecurity fundamentals

Scripting: PowerShell

Scripting: Python

Scripting: .NET/C#

Scripting: JavaScript

Analytical skills

Time management

Communication skills

Problem solving

DevSecOps understanding

Education

Bachelor’s Degree in Computer Science / Engineering / Cybersecurity

CISSP certification preferred

Tools

GitHub

Azure DevOps

TeamCity

Azure

AWS

GCP

Job description

CarMax is seeking a Cybersecurity Engineer II to advance our Application Security program within a Fortune 100 Best Places to Work environment. You will join a collaborative team focused on solving complex security challenges and enabling product innovation through secure development practices.

The role requires strong cybersecurity fundamentals, scripting skills, and experience with cloud and DevSecOps tools. On-site work at West Creek, VA with a 24x7 on-call rotation is required.