Manager, Enterprise Application Security & Controls

QXO • Seattle, WA

2d • $101,070 - $202,200

About The Position

The Manager, Enterprise Application Security and Controls leads the design, implementation, and operational effectiveness of security and controls across QXO’s enterprise applications. Oracle Fusion Cloud is the anchor platform, with the role’s scope extending to connected enterprise and boundary systems that exchange data with Oracle or support core financial, operational, and people processes. The manager leads a blended team of employees, contractors, and consultants and ensures access is appropriately designed, approved, provisioned, monitored, and periodically reviewed.

The position leads role architecture, user access governance, segregation of duties, privileged access, IT general controls, audit support, and security operations. It partners with Enterprise Applications, Cybersecurity, Internal Audit, Finance, Human Resources, business process owners, Engineering, and external support partners. As QXO grows through acquisitions and adopts new platforms, the role is expected to expand across a broader application portfolio and develop a consistent enterprise-wide security and controls framework.

Requirements

• At least 7 years of experience in enterprise application security, identity and access management, IT controls, risk management, audit, or related technology roles.
• At least 3 years of hands-on Oracle Fusion Cloud security experience, including role design, user administration, data access, security configuration, and production support.
• At least 3 years of direct people leadership experience managing a team responsible for application security, controls, access governance, or compliance operations, including hiring, performance management, and staff development.
• Demonstrated experience managing contractors, consultants, and outsourced service providers, including scoping work, overseeing statements of work, directing delivery, and holding partners accountable for quality, timelines, and cost.
• Deep understanding of Oracle Fusion Cloud security concepts, including abstract, job, duty, and data roles; privileges; role hierarchies; and data access assignments.
• Experience applying security and controls practices across multiple enterprise applications and learning new platform security models.
• Strong knowledge of segregation of duties, least privilege, privileged-access governance, user access reviews, and joiner-mover-leaver controls.
• Experience designing, operating, testing, and remediating SOX, IT general controls, and application controls in a complex enterprise environment.
• Experience supporting internal and external audits, responding to evidence requests, evaluating findings, and driving sustainable corrective actions.
• Working knowledge of identity lifecycle integrations, single sign-on, APIs, middleware, service accounts, and security dependencies across connected enterprise applications.
• Experience supporting implementations and releases through requirements, security design, configuration, testing, cutover, hypercare, change control, and production stabilization.
• Excellent leadership, communication, and judgment, with the ability to translate complex security and control requirements into practical decisions and accountable action plans.
• Travel is required to support implementation, audit, business engagement, rollout, and operational stabilization activities.

Nice To Haves

• Experience with Oracle Risk Management Cloud, Advanced Access Controls, Advanced Financial Controls, or a comparable governance, risk, and compliance platform.
• Experience with identity governance and administration (IGA) tools used to manage access and certifications across multiple applications.
• Experience bringing acquired or newly adopted applications into a common security and controls framework.
• Experience supporting a multi-business-unit, multi-country, acquisition-oriented, or branch-based operating environment.
• Oracle Cloud security certification, CISA, CISSP, CRISC, or another relevant security, risk, or audit credential.

Responsibilities

• Lead, develop, and manage a blended team of employees, contractors, and consultants, establishing clear ownership, service expectations, cross-training, documentation, and succession coverage.
• Manage direct reports, including hiring, onboarding, goal setting, performance management, coaching, career development, and recognition.
• Manage contractors and consultants, including defining resource needs, scoping work and statements of work, onboarding and access, directing work, reviewing deliverables, and managing performance and offboarding.
• Plan team capacity and resourcing across project demand, operational support needs, and budget.
• Own Oracle Fusion Cloud security architecture and role design, including job roles, duty roles, privileges, data roles, data access, and role hierarchies.
• Extend security and controls standards, role design principles, and governance practices to connected enterprise and boundary systems.
• Establish and enforce role-based access and least-privilege standards.
• Manage the end-to-end user access lifecycle across in-scope applications, including onboarding, transfers, terminations, access requests, approvals, provisioning, deprovisioning, access reviews, and exceptions.
• Lead segregation-of-duties governance within and across applications, including conflict-rule design, analysis, remediation, mitigating controls, documentation, and monitoring.
• Own security-related IT general controls and application controls, including control design, evidence collection, operating-effectiveness assessment, deficiency remediation, and audit support.
• Govern privileged, emergency, service, integration, and other non-person user access, including approval, monitoring, credential ownership, and periodic recertification.
• Assess and govern security across application integrations and data flows, including interface accounts, API access, middleware, and controls over data moving between Oracle and connected systems.
• Partner with Enterprise Applications leaders and business process owners on security requirements and controls for configurations, new capabilities, quarterly updates, integrations, releases, and production changes.
• Provide security and controls leadership for implementations, rollout waves, acquisitions, and business integrations, including fit-gap analysis, role mapping, access conversion, testing, cutover, and post-go-live stabilization.
• Assess the security and controls posture of acquired applications and newly adopted platforms, and define paths to align them with QXO standards.
• Coordinate with Cybersecurity, Identity and Access Management, Human Resources, Engineering, and application teams to maintain reliable identity data, automated provisioning, single sign-on, and appropriate access.
• Lead security testing and validation across environments, including role testing, negative testing, access reconciliation, production-readiness reviews, and validation after environment refreshes or major releases.
• Own production support outcomes for application security and controls, including incident response, access issues, root cause analysis, escalation management, corrective actions, and service-level performance.
• Manage application security vendors, consulting firms, and AMS partners, including contract and statement-of-work oversight and spend tracking, and ensure accountability, knowledge transfer, quality delivery, and compliance with security and change-management standards.
• Define and monitor security and controls measures, including provisioning timeliness, termination compliance, unresolved access conflicts, privileged-access exceptions, access-review completion, audit findings, and support backlog aging.

Benefits

• Annual performance bonus
• 401(k) with employer match
• Medical, dental, and vision insurance
• PTO, company holidays, and parental leave
• Paid time off and paid sick leave, with 15 days of PTO accrued during the first year and increased accruals after five years of service
• Paid training and certifications
• Legal assistance and identity protection
• Employee assistance program (EAP)

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed