Lead Application Security Engineer, Code to Cloud

About the role

As a Lead Application Security Engineer, Code to Cloud at QXO, you’ll be the recognized subject matter expert for application security across the company and own the engineering behind Code to Cloud: continuous security coverage across QXO’s software delivery lifecycle, from source code through pipeline execution to cloud runtime. QXO is building a modern cybersecurity function from the ground up, automation-first. This is a large, enterprise-wide program spanning three engineering organizations, and you will run your part of it with limited oversight, defining the standards QXO builds against rather than applying someone else’s. Attackers operate at machine speed, and human-speed review cannot meet that, so we automate first. QXO is a leading distributor and installer of building products serving an $800 billion market. The company’s mission is to modernize the building products industry through advanced technology and a best-in-class customer experience. QXO is North America’s largest distributor and installer of insulation, the second-largest distributor of roofing products, the second-largest publicly traded distributor of lumber and building materials, and the largest distributor of waterproofing products. The company is targeting $50 billion in annual revenue within the decade through accretive acquisitions and organic growth. For more information, visit QXO.com.

Responsibilities

• Own the scanning and posture platform end to end across secrets, SAST, SCA, infrastructure-as-code, container images, and cloud runtime, at a false-positive rate engineers trust.
• Build the automation that routes, deduplicates, and prioritizes findings, with owner resolution, SLA tracking, and closure verification.
• Build and run policy-based blocking controls in pull requests and CI/CD pipelines, as policy-as-code applied centrally and scoped to repository tiering, so coverage inherits to future repositories.
• Turn a gate on only when the baseline is triaged and false positives are under bar, and never block a team without a path forward.
• Author the application security standards, secure design patterns,