Principal Security Engineer

Cars.com; United States; On-site; USD 180,000 - 260,000; Full time

Job summary

Cars.com is seeking a seasoned Principal Security Engineer to design, implement, and manage our security posture. You will report to the CISO and influence cross‑functional teams across product, engineering, and IT.

You will lead threat defense, build secure architectures, mentor SecOps engineers, ensure regulatory compliance (PCI DSS, HIPAA, SOC 2), and drive secure SDLC and CI/CD practices.

Responsibilities

• Report directly to the CISO and influence executive-level initiatives.
• Architect and maintain a comprehensive security architecture for infrastructure and apps.
• Collaborate with Product and Engineering to embed security into processes.
• Lead Threat Defence and mentor SecOps engineers.
• Develop security policies, standards, and compliance with industry frameworks.
• Integrate security into SDLC and CI/CD pipelines.
• Perform security assessments, code reviews, and penetration testing.
• Design security controls for IaC, cloud, and containerized apps.
• Automate security testing and monitoring across pipelines.
• Monitor events, coordinate incident response, and mitigate impacts.
• Stay updated on threats and coordinate with leadership on mitigations.
• Allocate resources and prioritize security initiatives with senior leadership.
• Implement automated monitoring and logging for real-time detection.

Job description

Power confident decisions at Cars.com Cars.com is the marketplace millions of people trust to buy and sell cars with confidence.

More than 25 years ago, we started as a simple idea, connect buyers and sellers, and today we do a lot more: trusted reviews, transparent pricing, and real-time, proprietary data that cut through the noise of one of life's biggest purchases. Our scaled marketplace, paired with interconnected technology, data, and media, gives dealers and OEMs everything they need to sell more cars.

At Cars.com, we debate openly, decide fast, and deliver what we say we will. We solve real problems for car shoppers and dealers, simplify for speed, and focus on what matters most. We win together or not at all. Here, your work counts, your ideas can help shape what's next, and you'll build alongside people who have your back.

We're in the middle of a real transformation, modernizing the company and investing in AI and data to move faster. You're joining the No. 1 brand people think of first when shopping for a car, at the exact moment it's being rebuilt for what's next. You help decide what that becomes. That kind of influence is rare, and it's exactly why this is a place worth building your career.

Don't just take our word for it, we're proud to be named one of Built In's 2026 Best Places to Work in Chicago and across the U.S.

Ready to help build the most trusted place to buy and sell a car? Join us.

Do you thrive in fast-moving environments safeguarding critical systems? Are you passionate about staying ahead of the ever-evolving cyber threat landscape? If so, we want you on our team! We are seeking a seasoned Principal Security Engineer to join our growing security team. As a senior-level cybersecurity professional, you will play a pivotal role in designing, implementing, and managing our organization's security posture. You will be a trusted advisor to leadership, providing strategic direction and ensuring our security solutions align with industry best practices and compliance requirements.

Responsibilities

• Reporting directly to the CISO, this position offers executive-level exposure and cross-departmental experience. The individual will have the opportunity to make impactful contributions as they manage mission-critical initiatives and projects. The position will involve direct interaction with the executive team and corporate partners.
• Architect Secure Solutions: Design, implement, and maintain a comprehensive security architecture that safeguards our critical infrastructure, data, and applications. Design, implement, and maintain robust security controls and countermeasures across our IT and Product Cloud infrastructure.
• Collaborate with Product, Engineering, and other departments to integrate security best practices into business processes.
• Lead Threat Defense: Champion proactive security measures.
• Mentor a team of SecOps engineers, providing guidance and support in implementing security best practices.
• Develop and implement security policies, standards, and procedures to ensure compliance with regulatory requirements and industry best practices.
• Collaborate with development, operations, and security teams to integrate security into the software development lifecycle (SDLC) and CI/CD pipeline.
• Conduct security assessments, code reviews, and penetration testing to identify and mitigate vulnerabilities.
• Design and implement security controls for infrastructure as code (IaC), cloud environments, and containerized applications.
• Automate security testing and compliance checks using scripting and configuration management tools.
• Monitor and analyze security events and incidents, leading incident response efforts to minimize impact and prevent recurrence.
• Stay informed about emerging security threats, vulnerabilities, and industry trends, providing guidance on mitigation strategies.
• Partner with senior leadership to prioritize security initiatives and allocate resources effectively.
• Design and Implement automated monitoring and logging across the development and deployment pipeline to detect security incidents in real-time.
• Utilize security tools to monitor for suspicious activities and indicators of compromise.
• Integrate security alerts and notifications into the CI/CD pipeline to facilitate rapid detection and response.
• Upon detection of a security incident, initiate a thorough investigation to assess the scope and impact of the incident.
• Analyze logs, network traffic, and system configurations to identify the root cause of the incident and determine the extent of any compromise.
• Collaborate with development, operations, and security teams to gather relevant information and context for incident analysis.
• Compliance Champion: Ensure adherence to industry regulations and security compliance frameworks (e.g., PCI DSS, HIPAA, SOC 2).
• Security Advocacy & Awareness: Champion a culture of security awareness within the organization, developing and implementing security training programs for employee