{"id":2536480,"url":"https://alion.io/job/qxo-cybersecurity-lead-associate-third-party-risk-management","title":"Cybersecurity Lead Associate — Third-Party Risk Management","company":{"id":2455029,"name":"QXO","domain":"qxo.com","url":"https://alion.io/company/qxo","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":{"grade":"A","score":100,"open_postings":6,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":10,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Charlotte, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":101300,"max":172000,"currency":"USD","period":"year","gross":null,"usd_annual":172000},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"NIST CSF","optional":false}],"status":"live","first_seen_at":"2026-10-14T14:23:13Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-11-02T20:21:12Z","board_verified":true,"closed_at":null,"days_open":19,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":19},"description":"Overview\nAs a(n) Cybersecurity Lead Associate - Third-Party Risk Management at QXO, you’ll own and mature the Third-Party Risk Management (TPRM) program, including build out and day-to-day administration of our continuous vendor monitoring platform (SecurityScorecard). This role is central to QXO's ability to assess and manage cyber risk introduced through suppliers, technology vendors, and acquired entities as the company continues its acquisition-driven growth strategy.\nQXO is a leading distributor and installer of building products serving an $800 billion market. The company’s mission is to modernize the building products industry through advanced technology and a best-in-class customer experience. QXO is North America’s largest distributor and installer of insulation, the second-largest distributor of roofing products, the second-largest publicly traded distributor of lumber and building materials, and the largest distributor of waterproofing products. The company is targeting $50 billion in annual revenue within the decade through accretive acquisitions and organic growth. For more information, visit QXO.com.\nWhat you will do:\nIndependently own the cybersecurity TPRM program: continuous security posture monitoring, supplier due diligence assessments, contract negotiations and redlining, administration of multiple supplier risk management platforms\nLead the administration and optimize QXO's SecurityScorecard implementation, including score monitoring, alerting workflows, and vendor outreach for identified issues\nConduct security risk assessments of new and existing suppliers, with limited oversight and particular attention to vendors accessing Confidential or Highly Confidential QXO data\nServe as the subject matter expert and technical partner with Procurement, Legal, and Business Owners to ensure cybersecurity requirements are embedded in contracts and vendor onboarding\nTrack and report on third-party risk posture, remediation status, and program metrics to Cybersecurity leadership\nSupport due diligence for M&A activity, evaluating the cyber risk profile of acquisition targets and integration plans\nAdminister and maintain the Optro Third-Party Risk Management (TPRM) module, including workflow configuration, user access, and data integrity across compliance and vendor risk assessments.\nServe as the primary point of contact for Optro TPRM module support, troubleshooting issues, coordinating platform updates/enhancements, and training end users\nWhat you will bring:\n10+ years of experience in cybersecurity, IT risk management, and/or vendor risk management\nHands-on experience owning an Enterprise level program of significant complexity with multiple stakeholder groups\nWorking knowledge of NIST CSF 2.0 and third-party risk frameworks\nExperience conducting or reviewing security risk assessments\nStrong written communication skills - this role regularly produces risk assessments and executive-facing summaries\nExperience administering Enterprise level platforms used by diverse stakeholders\nWhat you will earn:\nBase pay range: $101,300 - $172,000\nAnnual performance bonus\n401(k) with employer match\nMedical, dental, and vision insurance\nPTO, company holidays, and parental leave\nPaid Time Off/Paid Sick Leave: Applicants can expect to accrue 15 days of paid time off during their first year (4.62 hours for every 80 hours worked) and increased accruals after five years of service.\nPaid training and certifications\nLegal assistance and identity protection\nPet insurance\nEmployee assistance program (EAP)\nTo comply with Pay Transparency laws, employers must disclose an annual salary range. Actual offers depend on factors such as location, experience, skills, and market data. This position may also offer variable compensation.\nPlease contact  if you have any questions related to this job posting.\nQXO is an Equal Opportunity Employer. We value diversity and do not discriminate on the basis of race, color, religion, gender or sexual orientation, national origin, age, disability, or any other protected status.\nPay Range\nUSD $101,300.00 - USD $172,000.00 /Yr.","description_format":"text","description_chars":4128,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Parental leave","Vision insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Security Compliance","Kitchens, Bathrooms & Home Improvement"],"lifecycle":[{"event":"open","at":"2026-10-14T14:23:13Z"}],"visa":[],"liveness":{"score":32,"band":"fade","label":"Fading","p_open":1,"p_active":0.71,"p_room":0.45,"age_days":18,"expected_fill_days":10,"reasons":["conf:3","velocity","win:tail","comp:brand"],"computed_at":"2026-11-02T06:13:15Z"},"pay":{"stated_usd_annual":172000,"is_top_pay":false},"html_url":"https://alion.io/job/qxo-cybersecurity-lead-associate-third-party-risk-management","json_url":"https://alion.io/job/qxo-cybersecurity-lead-associate-third-party-risk-management.json","meta":{"generated_at":"2026-11-03T00:02:09Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":88,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2455029},"rest":"https://alion.io/mcp/rest/get_company?id=2455029"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fqxo-cybersecurity-lead-associate-third-party-risk-management"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fqxo-cybersecurity-lead-associate-third-party-risk-management"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fqxo-cybersecurity-lead-associate-third-party-risk-management"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/qxo-cybersecurity-lead-associate-third-party-risk-management\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fqxo-cybersecurity-lead-associate-third-party-risk-management"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2536480}},{"tool":"search_jobs","arguments":{"company":"qxo.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2536480},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}