Privacy Operations Analyst II – AI-Driven Risk

CarMax; Richmond (VA); On-site; USD 79,000 - 118,000; Full time

Benefits offered by this job

Bonus and equity eligibility

Comprehensive benefits including paid/

Job summary

CarMax is seeking an Analyst II, Information Risk Management to maintain and enhance the company’s privacy and risk posture. You will collaborate with business and technology teams to assess data sensitivity, manage privacy requests, and drive process improvements using automation and AI.

The role focuses on facilitating regulatory privacy operations and ensuring a compliant posture for CarMax and customers, with opportunities to influence privacy practices across the enterprise.

Qualifications

• Bachelor’s degree in business / computer science / information systems (or related).
• 2+ years working experience in privacy, technology compliance, IT Audit, cybersecurity, or related experience.
• One or more privacy-focused certifications such as: CIPP, CIPM, CIPT, CIA, CRSC, CISA.
• Experience / familiarity with relevant U.S. legal frameworks and privacy regulation such as: CCPA, GLBA, PCI, NYDFS, CFPB.
• Detail oriented – keen eye for detail and accuracy in all operations.
• Analytical approach – data analysis, problem solving.
• Ability to apply risk-based privacy principles across disciplines.
• Customer Focus – exceptional internal customer service.
• Communication – clear verbal and written messaging.
• Collaboration – strong relationship building.
• Demonstrate initiative, ownership, and service mindset.

Responsibilities

• Privacy Request Support – coordinate with multiple tech teams to process DSARs.
• Privacy Operations Management – implement, execute and measure the program with KPIs.
• Process Improvement – identify opportunities to automate and improve privacy processes.
• Privacy Technology Administration – manage platforms and perform system improvements.
• Privacy Impact Assessment – facilitate ongoing data privacy assessments.
• Policy Governance Lifecycle Management – maintain policies and guidance.
• Knowledge Management – maintain internal playbooks and diagrams.
• Projects – participate in related privacy initiatives.
• Communicate effectively with peers and management about privacy operations.
• Keep up with industry trends and legal privacy requirements.

Skills

Privacy operations

Data analysis

Cross-functional collaboration

Communication

Problem solving

Ownership

Education

Bachelor’s degree in business / computer science / information systems

Job description

CarMax is seeking an Analyst II, Information Risk Management to maintain and enhance the company’s privacy and risk posture. You will collaborate with business and technology teams to assess data sensitivity, manage privacy requests, and drive process improvements using automation and AI.

The role focuses on facilitating regulatory privacy operations and ensuring a compliant posture for CarMax and customers, with opportunities to influence privacy practices across the enterprise.