CarGurus

CarGurus operates one of the highest-traffic consumer marketplaces on the internet - 46 million monthly unique visitors hitting its U.S. platform alone, generating billions of site interactions that need to be secured, analyzed, and kept available across the U.S., U.K., and Canada. The company runs the CarGurus online marketplace (the most visited automotive shopping site in the U.S.), PistonHeads (the U.K.'s largest online motoring community), and Autolist. That volume of consumer and dealer data - spanning over 34,000 global paying dealers and $907 million in FY 2025 revenue - defines a threat surface that includes payment fraud, account takeover, scraping at scale, and the usual web application attack vectors targeting high-traffic e-commerce platforms.

Founded in 2006 and profitable for over 15 years, CarGurus has built its competitive moat on data analytics and personalized predictive intelligence platforms. The security challenge sits at the intersection of protecting consumer PII and financial transactions, safeguarding proprietary pricing and inventory algorithms, and maintaining uptime on a platform where downtime directly impacts dealer revenue. The technical stack spans technology, data analytics, and ML-driven personalization - domains where security engineering has to be embedded, not bolted on.

The company's geographic footprint across three markets means dealing with differing regulatory regimes - state-level privacy laws in the U.S., GDPR in the U.K., and PIPEDA in Canada - on top of PCI-DSS obligations from dealer payment processing. For security practitioners, the draw is the scale: a profitable, publicly traded marketplace with real adversarial pressure from fraud rings, bot operators, and credential stuffing campaigns targeting a massive user base, backed by engineering teams that have had over a decade and a half to mature their infrastructure.