Senior Data Security Risk Analyst

Who we are
At CarGurus (NASDAQ: CARG), our mission is to give people the power to reach their destination. We started as a small team of developers determined to bring trust and transparency to car shopping. Since then, our history of innovation and go-to-market acceleration has driven industry-leading growth. In fact, we’re the largest and fastest-growing automotive marketplace, and we’ve been profitable for over 15 years.

What we do
The market is evolving, and we are too, moving the entire automotive journey online and guiding our customers through every step. That includes everything from the sale of an old car to the financing, purchase, and delivery of a new one. Today, tens of millions of consumers visit CarGurus.com each month, and ~30,000 dealerships use our products. But they're not the only ones who love CarGurus—our employees do, too. We have a people-first culture that fosters kindness, collaboration, and innovation, and empowers our Gurus with tools to fuel their career growth. Disrupting a trillion-dollar industry requires fresh and diverse perspectives. Come join us for the ride!

Working on the Information Security Risk and Compliance team, you will play a critical role in ensuring the confidentiality, integrity, and availability of data assets while complying with regulatory requirements and industry best practices. 

Identifying, classifying, and outlining mitigation plans for risks associated with the handling, storage, and transmission of sensitive data within our organization are core functions of this role.This position requires a deep understanding of data governance principles, data classification methodologies, strong understanding of technology risk management, and regulatory frameworks and compliance standards. 

A well-qualified candidate will be comfortable taking direction from management and be able to work autonomously when given an assignment or project.The candidate must have strong written, verbal communication and organization skills, and a solid understanding of different data storage technologies, regulations around data security and risk management. Project management and attention to detail as a must. They are also expected to help mentor junior members of the team. 

Responsibilities: 

Data Classification and Inventory:

• Develop and maintain a comprehensive inventory of organizational data assets, including their classification levels, sensitivity, and associated risks using our data security platform.
• Implement data classification frameworks and methodologies to categorize data according to its level of sensitivity, criticality, and regulatory requirements.
• Collaborate with business units and data owners to identify and document data flows, usage patterns, and access controls for classified data.

Risk Assessment and Analysis:

• Conduct thorough risk assessments of classified data assets to identify potential vulnerabilities, threats, and compliance gaps.
• Analyze and evaluate the effectiveness of existing controls and security measures in mitigating data-related risks.
• Develop risk treatment plans and mitigation strategies to address identified vulnerabilities and improve the overall security posture of data assets.

Compliance and Regulatory Alignment:

• Ensure compliance with relevant data protection regulations, such as GDPR, CCPA, etc., by assessing data handling practices against regulatory requirements.
• Monitor changes in data protection laws and regulations to ensure ongoing compliance and adapt data classification policies and procedures.
• Provide guidance and support to business units on regulatory requirements and industry best practices related to data classification and risk management.

Data Protection Controls:

• Recommend and implement technical controls, encryption mechanisms, access controls, and data loss prevention (DLP) solutions to protect classified data from unauthorized access, disclosure, or misuse.
• Conduct periodic assessments of data protection controls and security measures to validate their effectiveness and identify areas for improvement.
• Collaborate with  IT and Security teams to integrate data protection controls into technology systems and infrastructure.

Reporting and Communication:

• Prepare and present comprehensive risk assessment reports, findings, and recommendations to senior management.
• Communicate effectively with business units and data owners to raise awareness of data classification requirements, risks, and responsibilities.
• Collaborate with internal audit teams and external auditors to facilitate data classificat