Senior Technology Compliance & Controls Analyst

CarMax; Richmond (VA); On-site; USD 120,000 - 150,000; Full time

Benefits offered by this job

Onsite at Richmond VA

Job summary

CarMax is seeking a Senior Technology Compliance Analyst to strengthen the IT control environment. The role focuses on designing controls, validating compliance, and enabling automated evidence collection across domains such as PCI DSS, HIPAA, and data privacy.

The ideal candidate has 5+ years in IT compliance, relevant certifications, and strong communication skills to drive remediation and cross-functional collaboration in a fast-paced environment.

Qualifications

• Bachelor's degree or equivalent experience in IT audit or compliance.
• Familiarity with NIST, OWASP, SANS, ISO-27001/2, Cobit frameworks.
• 5+ years in enterprise technology compliance, ITGC and PCI assessments.
• CISA and/or CISSP required; CRISC, CIA, CISM, PCI are a plus.
• Strong communication, analytical, and mentoring abilities.

Responsibilities

• Develop and maintain a framework for technology compliance across IT domains (PCI DSS, HIPAA, Data Privacy).
• Execute enterprise governance frameworks and translate findings into actionable steps.
• Lead assessments and pre-implementation reviews to ensure controls are designed and documented.
• Design, implement, and maintain enterprise-wide GITCs and compliance programs.
• Enforce processes to align with policies, laws, and standards (NIST, ITIL).
• Advise on strategy, risk, and remediation; partner to evaluate control effectiveness.
• Assist management in automation and configuration to support evidence collection.
• Facilitate internal and external audits and communicate findings clearly.
• Monitor controls, analyze weakness trends, and propose enhancements.

Education

Bachelor's degree or equivalent in IT auditing/compliance

Job description

CarMax is seeking a Senior Technology Compliance Analyst to strengthen the IT control environment. The role focuses on designing controls, validating compliance, and enabling automated evidence collection across domains such as PCI DSS, HIPAA, and data privacy.

The ideal candidate has 5+ years in IT compliance, relevant certifications, and strong communication skills to drive remediation and cross-functional collaboration in a fast-paced environment.