Manager, Enterprise Application Security & Controls

The Manager, Enterprise Application Security and Controls is responsible for the day-to-day leadership, design, implementation, and operational effectiveness of security and control capabilities across QXO's enterprise applications. Oracle Fusion Cloud is the anchor platform for this role, and its scope will extend to the connected enterprise and boundary systems that exchange data with Oracle or support core financial, operational, and people processes. The role leads a blended team of employees, contractors, and consultants delivering security and controls services, and ensures that access is appropriately designed, approved, provisioned, monitored, and periodically reviewed across that application landscape.

The manager will lead role architecture, user access governance, segregation of duties, privileged access, IT general controls, audit support, and security operations. The role partners closely with Enterprise Applications, Cybersecurity, Internal Audit, Finance, Human Resources, business process owners, Engineering, and external support partners to protect QXO's systems while enabling efficient business operations. As QXO grows through acquisitions and adds new platforms, this role is expected to evolve, taking on a broader portfolio of applications and a more consistent, enterprise-wide security and controls framework.

QXO is a leading distributor and installer of building products serving an $800 billion market. The company’s mission is to modernize the building products industry through advanced technology and a best-in-class customer experience. QXO is North America’s largest distributor and installer of insulation, the second-largest distributor of roofing products, the second-largest publicly traded distributor of lumber and building materials, and the largest distributor of waterproofing products. The company is targeting $50 billion in annual revenue within the decade through accretive acquisitions and organic growth. For more information, visit QXO.com.

What you'll do:

• Lead, develop, and manage a blended team of employees, contractors, and consultants delivering application security and controls services, establishing clear ownership, service expectations, cross-training, documentation, and succession coverage.
• Own people management for direct reports, including hiring, onboarding, goal setting, performance management, coaching, career development, and recognition.
• Manage contractors and consultants end to end, including defining resource needs, scoping work and statements of work, onboarding and access, directing day-to-day work, reviewing deliverables, and managing performance and offboarding.
• Plan team capacity and resourcing, balancing employee, contractor, and consultant staffing against project demand, operational support needs, and budget.
• Own Oracle Fusion Cloud security architecture and role design, including job roles, duty roles, privileges, data roles, data access, and role hierarchies across enterprise application environments.
• Extend security and controls standards, role design principles, and governance practices to connected enterprise and boundary systems, building a consistent framework that scales as new applications are added.
• Establish and enforce role-based access and least-privilege standards that balance business usability, operational support, security requirements, and audit expectations.
• Manage the end-to-end user access lifecycle across in-scope applications, including onboarding, transfers, terminations, access requests, approvals, provisioning, deprovisioning, periodic access reviews, and exception handling.
• Lead segregation-of-duties governance within and across applications, including conflict-rule design, preventive and detective analysis, remediation, mitigating controls, documentation, and ongoing monitoring.
• Own security-related IT general controls and application controls, including control design, evidence collection, operating effectiveness, deficiency remediation, and support for internal and external audits.
• Govern privileged access, emergency access, service accounts, integration accounts, and other non-person user access, with appropriate approval, monitoring, credential ownership, and periodic recertification.
• Assess and govern security across application integrations and data flows, including interface accounts, API access, middleware, and controls over data moving between Oracle and connected systems.
• Partner with Enterprise Applications leaders and business process owners to review security requirements and controls for configurations, new capabilities, quarterly updates, integrations, releases, and production changes.
• Provide security and controls leadership for implementations, rollout waves, acquisitions, and business integrations, including fit-gap analysis, role mapping, access conversion, testing, cutover, and post-go-live stabilization.
• Assess the security and controls posture of applications brought in through acquisitions and new platform adoption, and define the path to align them with QXO standards.
• Coordinate with Cybersecurity, Identity and Access Management, Human Resources, Engineering, and application teams to maintain reliable identity data, automated provisioning, single sign-on, and appropriate access across connected systems.
• Lead security testing and validation across environments, including role testing, negative testing, access reconciliation, production-readiness reviews, and validation following environment refreshes or major releases.
• Own production support outcomes for application security and controls, including incident response, access issues, root cause analysis, escalation management, corrective actions, and service-level performance.
• Manage application security vendors, consulting firms, and AMS partners, including contract and statement-of-work oversight and spend tracking, ensuring clear accountability, effective knowledge transfer, quality delivery, and compliance with QXO security and change-management standards.
• Define and monitor security and controls measures such as provisioning timeliness, termination compliance, unresolved access conflicts, privileged-access exceptions, access-review completion, audit findings, and support backlog aging.

What you'll bring:

• 7+ years of experience in enterprise application security, identity and access management, IT controls, risk management, audit, or related technology roles.
• 3+ years of hands-on experience with Oracle Fusion Cloud security, including role design, user administration, data access, security configuration, and production support.
• 3+ years of prior people leadership experience directly managing a team responsible for application security, controls, access governance, or compliance operations, including hiring, performance management, and staff development.
• Demonstrated experience managing contractors, consultants, and outsourced service providers, including scoping work, overseeing statements of work, directing delivery, and holding partners accountable for quality, timelines, and cost.
• Deep understanding of Oracle Fusion Cloud security concepts, including abstract, job, duty, and data roles; privileges; role hierarchies; and data access assignments.
• Experience applying security and controls practices across multiple enterprise applications, with the ability to quickly learn the security models of new platforms.
• Strong knowledge of segregation of duties, least privilege, privileged-access governance, user access reviews, and joiner-mover-leaver controls.
• Experience designing, operating, testing, and remediating SOX, IT general controls, and application controls in a complex enterprise environment.
• Experience supporting internal and external audits, responding to evidence requests, evaluating findings, and driving sustainable corrective actions.
• Working knowledge of identity lifecycle integrations, single sign-on, APIs, middleware, service accounts, and security dependencies across connected enterprise applications.
• Experience supporting implementations and releases through requirements, security design, configuration, testing, cutover, hypercare, change control, and production stabilization.
• Excellent leadership, communication, and judgment, with the ability to translate complex security and control requirements into practical decisions and accountable action plans.
• Experience with Oracle Risk Management Cloud, Advanced Access Controls, Advanced Financial Controls, or a comparable governance, risk, and compliance platform.
• Experience with identity governance and administration (IGA) tools used to manage access and certifications across multiple applications.
• Experience bringing acquired or newly adopted applications into a common security and controls framework.
• Experience supporting a multi-business-unit, multi-country, acquisition-oriented, or branch-based operating environment.
• Oracle Cloud security certification, CISA, CISSP, CRISC, or another relevant security, risk, or audit credential.
• Travel will be required to support implementation, audit, business engagement, rollout, and operational stabilization activities.

What you'll earn

• Base pay range: $101,070 - $202,200
• Annual performance bonus
• 401(k) with employer match
• Medical, dental, and vision insurance
• PTO, company holidays, and parental leave
• Paid Time Off/Paid Sick Leave: Applicants can expect to accrue 15 days of paid time off during their first year (4.62 hours for every 80 hours worked) and increased accruals after five years of service.
• Paid training and certifications
• Legal assistance and identity protection
• Employee assistance program (EAP)

To comply with Pay Transparency laws, employers must disclose an annual salary range. Actual offers depend on factors such as location, experience, skills, and market data. This position may also offer variable compensation. 

QXO is an Equal Opportunity Employer. We value diversity and do not discriminate on the basis of race, color, religion, gender or sexual orientation, national origin, age, disability, or any other protected status.

USD $101,070.00 - USD $202,200.00 /Yr.

• Lead, develop, and manage a blended team of employees, contractors, and consultants delivering application security and controls services, establishing clear ownership, service expectations, cross-training, documentation, and succession coverage.
• Own people management for direct reports, including hiring, onboarding, goal setting, performance management, coaching, career development, and recognition.
• Manage contractors and consultants end to end, including defining resource needs, scoping work and statements of work, onboarding and access, directing day-to-day work, reviewing deliverables, and managing performance and offboarding.
• Plan team capacity and resourcing, balancing employee, contractor, and consultant staffing against project demand, operational support needs, and budget.
• Own Oracle Fusion Cloud security architecture and role design, including job roles, duty roles, privileges, data roles, data access, and role hierarchies across enterprise application environments.
• Extend security and controls standards, role design principles, and governance practices to connected enterprise and boundary systems, building a consistent framework that scales as new applications are added.
• Establish and enforce role-based access and least-privilege standards that balance business usability, operational support, security requirements, and audit expectations.
• Manage the end-to-end user access lifecycle across in-scope applications, including onboarding, transfers, terminations, access requests, approvals, provisioning, deprovisioning, periodic access reviews, and exception handling.
• Lead segregation-of-duties governance within and across applications, including conflict-rule design, preventive and detective analysis, remediation, mitigating controls, documentation, and ongoing monitoring.
• Own security-related IT general controls and application controls, including control design, evidence collection, operating effectiveness, deficiency remediation, and support for internal and external audits.
• Govern privileged access, emergency access, service accounts, integration accounts, and other non-person user access, with appropriate approval, monitoring, credential ownership, and periodic recertification.
• Assess and govern security across application integrations and data flows, including interface accounts, API access, middleware, and controls over data moving between Oracle and connected systems.
• Partner with Enterprise Applications leaders and business process owners to review security requirements and controls for configurations, new capabilities, quarterly updates, integrations, releases, and production changes.
• Provide security and controls leadership for implementations, rollout waves, acquisitions, and business integrations, including fit-gap analysis, role mapping, access conversion, testing, cutover, and post-go-live stabilization.
• Assess the security and controls posture of applications brought in through acquisitions and new platform adoption, and define the path to align them with QXO standards.
• Coordinate with Cybersecurity, Identity and Access Management, Human Resources, Engineering, and application teams to maintain reliable identity data, automated provisioning, single sign-on, and appropriate access across connected systems.
• Lead security testing and validation across environments, including role testing, negative testing, access reconciliation, production-readiness reviews, and validation following environment refreshes or major releases.
• Own production support outcomes for application security and controls, including incident response, access issues, root cause analysis, escalation management, corrective actions, and service-level performance.
• Manage application security vendors, consulting firms, and AMS partners, including contract and statement-of-work oversight and spend tracking, ensuring clear accountability, effective knowledge transfer, quality delivery, and compliance with QXO security and change-management standards.
• Define and monitor security and controls measures such as provisioning timeliness, termination compliance, unresolved access conflicts, privileged-access exceptions, access-review completion, audit findings, and support backlog aging.

• 7+ years of experience in enterprise application security, identity and access management, IT controls, risk management, audit, or related technology roles.
• 3+ years of hands-on experience with Oracle Fusion Cloud security, including role design, user administration, data access, security configuration, and production support.
• 3+ years of prior people leadership experience directly managing a team responsible for application security, controls, access governance, or compliance operations, including hiring, performance management, and staff development.
• Demonstrated experience managing contractors, consultants, and outsourced service providers, including scoping work, overseeing statements of work, directing delivery, and holding partners accountable for quality, timelines, and cost.
• Deep understanding of Oracle Fusion Cloud security concepts, including abstract, job, duty, and data roles; privileges; role hierarchies; and data access assignments.
• Experience applying security and controls practices across multiple enterprise applications, with the ability to quickly learn the security models of new platforms.
• Strong knowledge of segregation of duties, least privilege, privileged-access governance, user access reviews, and joiner-mover-leaver controls.
• Experience designing, operating, testing, and remediating SOX, IT general controls, and application controls in a complex enterprise environment.
• Experience supporting internal and external audits, responding to evidence requests, evaluating findings, and driving sustainable corrective actions.
• Working knowledge of identity lifecycle integrations, single sign-on, APIs, middleware, service accounts, and security dependencies across connected enterprise applications.
• Experience supporting implementations and releases through requirements, security design, configuration, testing, cutover, hypercare, change control, and production stabilization.
• Excellent leadership, communication, and judgment, with the ability to translate complex security and control requirements into practical decisions and accountable action plans.
• Experience with Oracle Risk Management Cloud, Advanced Access Controls, Advanced Financial Controls, or a comparable governance, risk, and compliance platform.
• Experience with identity governance and administration (IGA) tools used to manage access and certifications across multiple applications.
• Experience bringing acquired or newly adopted applications into a common security and controls framework.
• Experience supporting a multi-business-unit, multi-country, acquisition-oriented, or branch-based operating environment.
• Oracle Cloud security certification, CISA, CISSP, CRISC, or another relevant security, risk, or audit credential.
• Travel will be required to support implementation, audit, business engagement, rollout, and operational stabilization activities.