Senior Engineer, Information Security

Carvana; Tempe (AZ); Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401K with company match

Student loan payments

Vehicle discounts

Pet benefits

Wellness program

Training opportunities

Job summary

Carvana is seeking a Senior Engineer, Information Security to join our Security Architecture and Engineering Team in Tempe. You will design security architectures for cloud, data, and network environments, review new products, and guide engineering partners on risk-based decisions.

You will embed security into the engineering lifecycle, drive the security technology roadmap, and maintain critical security tools.

Qualifications

• 5+ years of experience in security engineering, software development or equivalent work experience.
• Proven experience in managing a diverse and wide range of enterprise security technologies.
• Strong proficiency in scripting and software development languages for API integration.
• Experience designing AI-driven automation or integrating AI/LLM capabilities into operational workflows.
• Demonstrated experience in security architecture, including threat modeling, reference architecture design, and architecture reviews across cloud and enterprise environments.
• Working knowledge of AI and LLM security risks and frameworks such as the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework.
• Ability to communicate risk and design tradeoffs clearly to both technical teams and business leaders.
• Deep understanding of RESTful APIs and experience integrating various security tools.
• Proven experience in securing a complex, diverse, distributed technology footprint.

Responsibilities

• Design and document security architecture patterns, reference designs, and standards for cloud, application, data, identity, and network environments.
• Perform security architecture reviews of new products, platforms, and vendor solutions, and turn findings into practical, risk-based guidance for engineering and business partners.
• Embed security by design into the engineering lifecycle through guardrails, paved paths, and reusable patterns that make the secure choice the easy choice.
• Contribute to the security technology roadmap and align architecture decisions with business priorities and risk appetite.
• Maintain various security technologies across the enterprise to ensure that the technologies are operational and providing value to the organization.
• Leverage the information from disparate security technologies to improve our security risk posture.
• Engineer solutions that can drive automated response to known security risks, when appropriate.
• Leverage artificial intelligence (AI) to build and optimize our security technologies, including detection, triage, enrichment, and response workflows.
• Design and secure AI and LLM enabled solutions, including agentic workflows, addressing risks such as prompt injection, data leakage, excessive agency, and model supply chain exposure.
• Define security architecture and guardrails for enterprise AI adoption, including access control, data handling, logging, monitoring, and human oversight.
• Partner with engineering, data, legal, and privacy teams to establish practical AI security standards that enable the business to move fast with managed risk.
• Partner with cross-functional stakeholders to drive risk reduction using a risk-based approach.
• Identify and address risks in the organization and partner with teams to close the gaps.
• Evaluate emerging technologies and determine whether new investments are required.
• Identify and implement additional use cases to automate repetitive or operational tasks using our agentic AI solution.

Skills

Security engineering

Threat modeling

REST APIs

AI security

Scripting

Architecture reviews

Cloud security

Cross-functional

Communication

Education

Bachelor's degree

Tools

SIEM

IAM

IDS/IPS

Firewall

DLP

Job description

About Carvana

At Carvana, we're changing the way people buy and sell cars. With an ambitious vision and a fundamentally different approach designed to be fun, fast, and fair, Carvana became the fastest-growing automotive retailer in history. We expanded nationally, went public on the New York Stock Exchange, sold our 1 millionth car, and reached the Fortune 500, all in just eight years.

Today, with 4 million retail customers and counting, Carvana is both the fastest-growing and the most profitable public automotive retailer, and we're just getting started. We continue to raise the bar for our customers as we tackle the enormous opportunity still ahead in the largest consumer vertical.

Working here means being part of a team that embraces change, celebrates creative problem solving, and always strives to be better. At Carvana, you'll have the opportunity to take on meaningful challenges, learn quickly, and help shape the future of automotive retail. If you're driven to grow and make an impact as part of a collaborative team, you'll fit right in. Learn more about what it's like to work here from people that already do.

Work Model: This is a 100% on-site role at our Tempe office, Monday through Friday.

About the team and position

We are looking for a Senior Engineer, Information Security to join our Security Architecture and Engineering Team that will manage our various security technologies that are used to operate our holistic information security program. You will be responsible for evaluating, managing and maintaining our security technologies.

What you'll be doing

• Design and document security architecture patterns, reference designs, and standards for cloud, application, data, identity, and network environments.
• Perform security architecture reviews of new products, platforms, and vendor solutions, and turn findings into practical, risk-based guidance for engineering and business partners.
• Embed security by design into the engineering lifecycle through guardrails, paved paths, and reusable patterns that make the secure choice the easy choice.
• Contribute to the security technology roadmap and align architecture decisions with business priorities and risk appetite.
• Maintain various security technologies across the enterprise to ensure that the technologies are operational and providing value to the organization.
• Leverage the information from disparate security technologies to improve our security risk posture.
• Engineer solutions that can drive automated response to known security risks, when appropriate.
• Leverage artificial intelligence (AI) to build and optimize our security technologies, including detection, triage, enrichment, and response workflows.
• Design and secure AI and LLM enabled solutions, including agentic workflows, addressing risks such as prompt injection, data leakage, excessive agency, and model supply chain exposure.
• Define security architecture and guardrails for enterprise AI adoption, including access control, data handling, logging, monitoring, and human oversight.
• Partner with engineering, data, legal, and privacy teams to establish practical AI security standards that enable the business to move fast with managed risk.
• Partner with cross-functional stakeholders to drive risk reduction using a risk-based approach.
• Identify and address risks in the organization and partner with teams to close the gaps.
• Evaluate emerging technologies and determine whether new investments are required.
• Identify and implement additional use cases to automate repetitive or operational tasks using our agentic AI solution.

What you should have

• 5+ years of experience in security engineering, software development or equivalent work experience.
• Proven experience in managing a diverse and wide range of enterprise security technologies.
• Strong proficiency in scripting and software development languages for API integration.
• Experience designing AI-driven automation or integrating AI/LLM capabilities into operational workflows.
• Demonstrated experience in security architecture, including threat modeling, reference architecture design, and architecture reviews across cloud and enterprise environments.
• Working knowledge of AI and LLM security risks and frameworks such as the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework.
• Ability to communicate risk and design tradeoffs clearly to both technical teams and business leaders.
• Deep understanding of RESTful APIs and experience integrating various security tools.
• Proven experience in securing a complex, diverse, distributed technology footprint.

It would be great if you also had

• Experience in working in a highly matrixed organization.
• Industry specific certification.

What we'll offer in return

• Full-Time Salary Position with a competitive salary.
• Medical, Dental, and Vision benefits.
• 401K with company match.
• A multitude of perks including student loan payments, discounts on vehicles, benefits for your pets, and much more.
• A great wellness program to keep you healthy and happy both physically and mentally.
• Access to training and conference opportunities as well as great on-the-job training.
• A company culture of promotions from within, with a start-up atmosphere allowing for varied and rapid career development.
• A seat in one of the fastest-growing companies in the country.

Other requirements

To be able to do your job at Carvana, there are some basic requirements we want to share with you.

• Must be able to read, write, speak, and understand English.

Of course, we'll make any reasonable accommodations for those with disabilities to perform the essential functions of their jobs.

Legal stuff

Hiring is contingent on passing a complete background check. This role is not eligible for visa sponsorship.

Carvana is an equal employment opportunity employer. All applicants receive consideration for employment without regard to race, color, religion, gender, sexual orientation, gender identity or expression, marital status, national origin, age, mental or physical disability, protected veteran status, or genetic information, or any other basis protected by applicable law. Carvana also prohibits harassment of applicants or employees based on any of these protected categories.

Please note this job description is not designed to contain a comprehensive listing of activities, duties, or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.