Senior Manager, Data Protection & Forensics

QXO•Charlotte, NC

5d•$140,400 - $210,600

About The Position

As Senior Manager, Data Protection & Forensics at QXO, you will lead the company’s data loss prevention and digital forensics functions with an automation-first approach. You will own the enterprise DLP platform, data discovery and classification, data security posture management, insider risk, forensic investigations, and eDiscovery support. The role includes integrating acquired companies’ data into consistent controls, extending protection and investigations to generative AI, and ensuring evidence is collected and handled to standards suitable for litigation, regulatory inquiries, and law enforcement referrals. You will lead and develop a small team of data security analysts; build automated playbooks and operational standards mapped to NIST CSF 2.0; report risk and program metrics; and partner with IT, Data & Analytics, Engineering, and Legal to implement controls while supporting business operations. You will brief executives, Legal, and HR on findings in clear language. QXO is a distributor and installer of building products serving an $800 billion market. Its mission is to modernize the building products industry through advanced technology and a best-in-class customer experience. QXO is North America’s largest distributor and installer of insulation, among the largest distributors of roofing products and lumber and building materials, and the largest distributor of waterproofing products. It is targeting $50 billion in annual revenue within the decade through acquisitions and organic growth.

Requirements

At least 7 years of information security experience, including hands-on experience in both data protection (DLP, classification, DSPM, or insider risk) and digital forensics or incident response.
At least 2 years of people leadership experience.
Hands-on administration of an enterprise DLP platform at scale, including writing policies and tuning alerts.
Working command of forensic acquisition and analysis for disk, memory, mobile, and cloud, and of chain-of-custody practices.
Experience running eDiscovery collections and legal holds and conducting investigations with HR and Legal under privilege.
Scripting experience in Python or PowerShell and experience with SOAR or workflow automation.
Working knowledge of NIST CSF 2.0 and regulations and standards relevant to a public company, including PCI DSS, CMMC, state privacy laws, and SEC cybersecurity disclosure.
Sound judgment and discretion when handling sensitive material and personnel matters and making decisions with incomplete facts.
Clear writing and briefing skills for executives and counsel.
Bachelor’s degree in computer science, information systems, or a related field, or equivalent experience.

Nice To Haves

CISSP certification.
GCFA, GCFE, GCFR, or EnCE certification.
CIPP/US or CIPT certification.
Experience in a multi-company or M&A integration environment.

Responsibilities

Own the enterprise DLP platform, including architecture, administration, policy design, tuning, and alert triage across endpoint, email, web, cloud, and SaaS.
Build and operate data discovery and classification to identify the locations of customer, employee, financial, and payment data across a multi-cloud environment.
Run data security posture management to identify overexposed, stale, or redundant data and remove unnecessary access.
Integrate acquired companies’ data under common controls on a defined timeline.
Extend DLP and investigations to generative AI, including monitoring data entered into AI tools and preserving prompts and outputs as evidence.
Run the insider risk program from signal through case closure, collaborating with HR, Legal, Privacy, and Employee Relations.
Lead digital forensic examinations across Windows, macOS, Linux, mobile devices, cloud workloads, and collaboration platforms, from collection and preservation through analysis and reporting.
Own evidence handling and chain of custody to support litigation, regulatory inquiries, and law enforcement referrals.
Provide forensic support for major incidents by determining scope and root cause and supplying evidence for materiality decisions and after-action reports.
Run eDiscovery collections and legal holds for Legal and outside counsel, and manage outside forensic and eDiscovery firms when needed.
Brief executives, Legal, and HR on findings in plain language.
Lead, hire, coach, and develop a small team of data security analysts.
Build automated playbooks to triage DLP alerts, enrich cases, and resolve low-risk volume without human intervention.
Write and maintain data protection and forensics standards, procedures, and runbooks mapped to NIST CSF 2.0.
Report metrics including policy coverage, true-positive rate, time to triage, case cycle time, and sensitive-data exposure trends.
Partner with IT, Data & Analytics, Engineering, and Legal to implement controls without slowing the business.

Benefits

Annual performance bonus.
401(k) with employer match.
Medical, dental, and vision insurance.
Paid time off and company holidays.
Parental leave.
Paid training and certifications.
Legal assistance and identity protection.
Pet insurance.
Employee assistance program (EAP).
Paid time off and paid sick leave accrual, with increased accruals after five years of service.