Hybrid Information Security Risk & Compliance Analyst

CarGurus; Boston (MA); On-site; USD 84,000 - 106,000; Full time

Benefits offered by this job

Equity for all employees

Hybrid work model

Generous time off

Job summary

CarGurus in Boston is seeking an Information Security Risk and Compliance Analyst to manage security risk, ensure regulatory compliance, and partner with security, engineering, legal, finance, and procurement to strengthen the company’s security posture.

The role covers third party risk management, customer security assurance, cyber risk management, SOX ITGC governance, and security governance initiatives, with a focus on scalable processes and improved audit readiness.

Qualifications

• Experience with governance, risk, and compliance (GRC) platforms and tools.
• Professional certifications in information security (e.g., CISSP, CISA, CRISC, Security+ or CISM).
• Experience supporting cloud environments and security workflows.

Responsibilities

• Manage security risk and regulatory compliance initiatives.
• Lead third party risk management and customer security assurance activities.
• Oversee cyber risk management, SOX ITGC governance, and security governance initiatives.

Skills

GRC platforms

CISSP

CISA

CRISC

Security+

CISM

Cloud environments

AI governance

Tools

Auditboard

SAFE

Loopio

Job description

CarGurus in Boston is seeking an Information Security Risk and Compliance Analyst to manage security risk, ensure regulatory compliance, and partner with security, engineering, legal, finance, and procurement to strengthen the company’s security posture.

The role covers third party risk management, customer security assurance, cyber risk management, SOX ITGC governance, and security governance initiatives, with a focus on scalable processes and improved audit readiness.