Manager, Enterprise Application Security & Controls

The Manager, Enterprise Application Security and Controls is responsible for the day-to-day leadership, design, implementation, and operational effectiveness of security and control capabilities across QXO's enterprise applications. Oracle Fusion Cloud is the anchor platform for this role, and its scope will extend to the connected enterprise and boundary systems that exchange data with Oracle or support core financial, operational, and people processes.

The role leads a blended team of employees, contractors, and consultants delivering security and controls services, and ensures that access is appropriately designed, approved, provisioned, monitored, and periodically reviewed across that application landscape.

The manager will lead role architecture, user access governance, segregation of duties, privileged access, IT general controls, audit support, and security operations. The role partners closely with Enterprise Applications, Cybersecurity, Internal Audit, Finance, Human Resources, business process owners, Engineering, and external support partners to protect QXO's systems while enabling efficient business operations. As QXO grows through acquisitions and adds new platforms, this role is expected to evolve, taking on a broader portfolio of applications and a more consistent, enterprise-wide security and controls framework.

QXO is a leading distributor and installer of building products serving an $800 billion market. The company's mission is to modernize the building products industry through advanced technology and a best-in-class customer experience. QXO is North America's largest distributor and installer of insulation, the second-largest distributor of roofing products, the second-largest publicly traded distributor of lumber and building materials, and the largest distributor of waterproofing products.

The company is targeting $50 billion in annual revenue within the decade through accretive acquisitions and organic growth. For more information, visit

• Lead, develop, and manage a blended team of employees, contractors, and consultants delivering application security and controls services, establishing clear ownership, service expectations, cross-training, documentation, and succession coverage.
• Own people management for direct reports, including hiring, onboarding, goal setting, performance management, coaching, career development, and recognition.
• Manage contractors and consultants end to end, including defining resource needs, scoping work and statements of work, onboarding and access, directing day-to-day work, reviewing deliverables, and managing performance and offboarding.
• Plan team capacity and resourcing, balancing employee, contractor, and consultant staffing against project demand, operational support needs, and budget.
• Own Oracle Fusion Cloud security architecture and role design, including job roles, duty roles, privileges, data roles, data access, and role hierarchies across enterprise application environments.
• Extend security and controls standards, role design principles, and governance practices to connected enterprise and boundary systems, building a consistent framework that scales as new applications are added.
• Establish and enforce role-based access and least-privilege standards that balance business usability, operational support, security requirements, and audit expectations.
• Manage the end-to-end user access lifecycle across in-scope applications, including onboarding, transfers, terminations, access requests, approvals, provisioning, deprovisioning, periodic access reviews, and exception handling.
• Lead segregation-of-duties governance within and across applications, including conflict-rule design, preventive and detective analysis, remediation, mitigating controls, documentation, and ongoing monitoring.
• Own security-related IT general controls and application controls, including control design, evidence collection, operating effectiveness, deficiency remediation, and support for internal and external audits.
• Govern privileged access, emergency access, service accounts, integration accounts, and other non-person user access, with appropriate approval, monitoring, credential ownership, and periodic recertification.
• Assess and govern security across application integrations and data flows, including interface accounts, API access, middleware, and controls over data moving between Oracle and connected systems.
• Partner with Enterprise Applications leaders and business process owners to…