Principal Security Engineer

Power confident decisions at Cars.com

Cars.com is the marketplace millions of people trust to buy and sell cars with confidence.

More than 25 years ago, we started as a simple idea, connect buyers and sellers, and today we do a lot more: trusted reviews, transparent pricing, and real-time, proprietary data that cut through the noise of one of life's biggest purchases. Our scaled marketplace, paired with interconnected technology, data, and media, gives dealers and OEMs everything they need to sell more cars.

At Cars.com, we debate openly, decide fast, and deliver what we say we will. We solve real problems for car shoppers and dealers, simplify for speed, and focus on what matters most. We win together or not at all. Here, your work counts, your ideas can help shape what’s next, and you’ll build alongside people who have your back.

We’re in the middle of a real transformation, modernizing the company and investing in AI and data to move faster. You're joining the No. 1 brand people think of first when shopping for a car, at the exact moment it's being rebuilt for what's next. You help decide what that becomes. That kind of influence is rare, and it's exactly why this is a place worth building your career.

Don't just take our word for it, we're proud to be named one of Built In's 2026 Best Places to Work in Chicago and across the U.S.

Ready to help build the most trusted place to buy and sell a car? Join us.

Do you thrive in fast-moving environments safeguarding critical systems? Are you passionate about staying ahead of the ever-evolving cyber threat landscape? If so, we want you on our team! We are seeking a seasoned Principal Security Engineer to join our growing security team. As a senior-level cybersecurity professional, you will play a pivotal role in designing, implementing, and managing our organization's security posture. You will be a trusted advisor to leadership, providing strategic direction and ensuring our security solutions align with industry best practices and compliance requirements.

Responsibilities

Reporting directly to the CISO, this position offers executive-level exposure and cross-departmental experience. The individual will have the opportunity to make impactful contributions as they manage mission-critical initiatives and projects. The position will involve direct interaction with the executive team and corporate partners.

• Architect Secure Solutions: Design, implement, and maintain a comprehensive security architecture that safeguards our critical infrastructure, data, and applications.
  • Design, implement, and maintain robust security controls and countermeasures across our IT and Product Cloud infrastructure.
  • Collaborate with Product, Engineering, and other departments to integrate security best practices into business processes.
• Lead Threat Defense: Champion proactive security measures.
• Mentor a team of SecOps engineers, providing guidance and support in implementing security best practices.
• Develop and implement security policies, standards, and procedures to ensure compliance with regulatory requirements and industry best practices.
• Collaborate with development, operations, and security teams to integrate security into the software development lifecycle (SDLC) and CI/CD pipeline.
• Conduct security assessments, code reviews, and penetration testing to identify and mitigate vulnerabilities.
• Design and implement security controls for infrastructure as code (IaC), cloud environments, and containerized applications.
• Automate security testing and compliance checks using scripting and configuration management tools.
• Monitor and analyze security events and incidents, leading incident response efforts to minimize impact and prevent recurrence.
• Stay informed about emerging security threats, vulnerabilities, and industry trends, providing guidance on mitigation strategies.
• Partner with senior leadership to prioritize security initiatives and allocate resources effectively.
• Design and Implement automated monitoring and logging across the development and deployment pipeline to detect security incidents in real-time.
• Utilize security tools to monitor for suspicious activities and indicators of compromise.
• Integrate security alerts and notifications into the CI/CD pipeline to facilitate rapid detection and response.
• Upon detection of a security incident, initiate a thorough investigation to assess the scope and impact of the incident.
• Analyze logs, network traffic, and system configurations to identify the root cause of the incident and determine the extent of any compromise.
• Collaborate with development, operations, and security teams to gather relevant information and context for incident analysis.
• Compliance Champion: Ensure adherence to industry regulations and security compliance frameworks (e.g., PCI DSS, HIPAA, SOC 2).
• Security Advocacy & Awareness: Champion a culture of security awareness within the organization, developing and implementing security training programs for employees.

Qualifications:

• Minimum 10 years of experience in information security with a proven track record of success in a similar role.
• In-depth knowledge of security principles, technologies, and methodologies (e.g., firewalls, intrusion detection/prevention systems, encryption, IAM).
• In-depth understanding of DevOps principles, methodologies, and tools.
• Hands-on experience with cloud platforms (e.g., AWS, Azure, GCP), containerization technologies (e.g., Docker, Kubernetes), and infrastructure as code (IaC) tools.
• Proficiency in scripting languages such as Python, PowerShell, or Bash.
• Familiarity with compliance standards such as PCI DSS, SOC II, and ISO27001.
• Excellent communication, collaboration, and problem-solving skills.
• Knowledge of secure software development frameworks (e.g., OWASP).
• Experience implementing security in Agile and DevOps environments.

Preferred Qualifications:

• Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience).
• Security certifications such as CISSP, CISM, or AWS Certified Security Specialty.
• Deep Experience in the following technologies:
  • Cloudflare
  • Crowdstrike
  • Proofpoint
  • CyberArk EPM
  • BurpSuite
  • Amazon Security Hub, Guard Duty, Inspector
  • JumpCloud
  • Snyk
• Experience in developing security budgets

Compensation

Benefits

Confidence, built in. The same confidence we build for car buyers and sellers, we build into how we treat our own:

• Medical, dental & vision from day one — no waiting period
• 401(k) with company match, immediate vesting
• Employee Stock Purchase Plan — buy Cars.com stock at a discount
• Unlimited Flex Time Off, 11 paid holidays, 1 volunteer day
• Paid parental and caregiver leave
• $350 one-time home office stipend + $70/month for virtual-first work
• Tuition reimbursement up to $5,250/year
• ...and more — see our full Benefits, Perks & Culture here

Legal

For US-based positions: Applicants must be authorized to work in the United States. We're unable to sponsor employment visas at this time.

Cars.com is an equal opportunity employer and values diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Applicants: click here to review our Privacy Policy for Applicants.

Current employees: click here to review our California Privacy Policy for Employees.

Who we are & what we do

Cars.com is a leading marketplace for automotive sales. For over 25 years, we've helped millions of people cut through the noise and make real decisions about buying and selling cars. Behind that is a team that genuinely loves solving hard problems — for shoppers, for dealers and automakers, and for each other.

Brand & sub-brands

• U.S. Cars.com: You'll work under the Cars.com name.
• U.S. Dealer Inspire: You'll work for Cars.com, but build our Dealer Inspire technology. Dealer Inspire is owned by Cars.com and serves as our digital experience sub-brand for dealers in the U.S.
• Canada: You'll work for Cars.com, but build our D2C Media technology for the Canadian market. D2C Media is owned by Cars.com and serves as our digital experience brand in Canada.

Where we're going

We're building trust in an industry that has historically struggled with it. We give shoppers clarity and certainty in one of life's biggest purchases, and we give dealers and automakers a marketplace and the technology that actually grows their business.

Our transformation

Cars.com is in the middle of a real transformation — modernizing the company, investing in AI and data, and moving faster than ever. We have a powerful brand name and all the ingredients needed to win. What we don't have yet is everyone we need to get there. That's where you come in. We are looking for strong talent to help build what’s next.