{"id":2536455,"url":"https://alion.io/job/qxo-lead-associate-engineer-identity-and-access-management","title":"Lead Associate Engineer, Identity and Access Management","company":{"id":2455029,"name":"QXO","domain":"qxo.com","url":"https://alion.io/company/qxo","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":{"grade":"A","score":100,"open_postings":5,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":9,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Charlotte, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":101300,"max":172000,"currency":"USD","period":"year","gross":null,"usd_annual":172000},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SOAP","optional":false}],"status":"live","first_seen_at":"2026-10-14T14:23:13Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-30T06:26:42Z","board_verified":true,"closed_at":null,"days_open":15,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":15},"description":"Overview\nAs a Lead Associate Engineer, Identity and Access Management at QXO, you'll serve as the recognized subject matter expert leading the engineering behind QXO's new Identity Governance and Automation (IGA) program: a greenfield deployment, from connectors and provisioning workflows through access certification, with no legacy platform to inherit or migrate from. The role is expected to grow into a broader IAM remit - including coaching and reviewing the work of other IAM engineers - as QXO's identity portfolio expands.\nQXO is a leading distributor and installer of building products serving an $800 billion market. The company’s mission is to modernize the building products industry through advanced technology and a best-in-class customer experience. QXO is North America’s largest distributor and installer of insulation, the second-largest distributor of roofing products, the second-largest publicly traded distributor of lumber and building materials, and the largest distributor of waterproofing products. The company is targeting $50 billion in annual revenue within the decade through accretive acquisitions and organic growth. For more information, visit QXO.com.\nWhat you will do:\nPush automation as the default: treat every manual, ticket-driven, or spreadsheet-based step as something to simplify, standardize, and automate - not a process to maintain.\nImplement and configure QXO's selected IGA platform including connectors, provisioning logic, and workflow automation.\nBuild automated joiner-mover-leaver (JML) workflows that connect authoritative HR data to birthright and requestable access across target systems.\nDesign and build integrations to target systems where out-of-the-box connectors don't already cover the gap.\nConfigure segregation-of-duties (SoD) detection rules and access-certification campaign workflows, and build the audit trail and reporting these depend on.\nServe as the subject matter expert and technical partner to Infrastructure, Engineering, Enterprise Applications, and HR Ops on integration points as the program scales.\nServe as the liaison to GRC and the broader Cybersecurity team on risk remediation, hardening, and control issues that surface in the IGA platform, partnering to resolve them as they arise.\nStay engaged with QXO's broader identity landscape - access management, privileged access management, and directory services - as the identity portfolio ownership expands beyond IGA.\nTake a POC/POV-validated design into production build-out - standing up the platform, connectors, and workflows for the first time, with no legacy IGA system to unwind.\nDeliver IGA build work on time and within scope, translating business-unit access requirements directly into automated workflows rather than one-off manual accommodations.\nDocument configuration decisions, policy exceptions, and workflow logic clearly enough that automation is auditable and repeatable, not tribal knowledge.\nDrive the technical direction of the IGA program as a large-scale, cross-functional engineering initiative with limited oversight from the Director, architecting the connectors, workflows, and integration build-out.\nCoach, review, and delegate work to other IAM engineers and analysts, ensuring quality and consistency in configuration and design decisions as the team scales.\nWhat you will bring:\n10+ years of hands-on IAM/IGA engineering experience, with the depth to serve as a recognized subject matter expert configuring and building on an IGA/IAM platform (Saviynt, SailPoint, Linx, or similar) - not just administering it.\nExperience building or configuring connectors and integrations: SCIM, REST/SOAP APIs, or a vendor connector framework.\nSolid understanding of identity lifecycle (JML) processes, RBAC/role modeling, and segregation-of-duties concepts.\nA holistic understanding of IAM beyond governance - access management, privileged access management (PAM), and directory services - and how they interlock with IGA.\nScripting or automation ability (Python, PowerShell, or similar) for custom integration and provisioning logic.\nStrong cross-functional communication; you'll work directly with HR, Enterprise Applications, Infrastructure, and Engineering stakeholders, not just other security engineers.\nExperience coaching, reviewing, and delegating work to less-experienced engineers, with sound judgment on when to guide versus when to step in directly.\nDemonstrated ability to solve difficult and often complex, ambiguous problems in identity infrastructure and access controls with limited precedent to draw on, applying least-privilege thinking as a default rather than an afterthought.\nPreferred: experience standing up a greenfield IAM/IGA deployment - building a program from zero rather than extending or migrating an existing one - including working alongside managed-services or implementation partners during a POC/POV phase.\nPreferred: awareness of non-human identity (NHI) and agentic AI access-control concepts. QXO's identity program will eventually extend to governing machine and AI-agent identities as that footprint grows - applicants should be able to speak to how least privilege, certification, and SoD principles extend to non-human actors.\nWhat you will earn:\nBase pay range: $101,300 - $172,000\nAnnual performance bonus\n401(k) with employer match\nMedical, dental, and vision insurance\nPTO, company holidays, and parental leave\nPaid Time Off/Paid Sick Leave: Applicants can expect to accrue 15 days of paid time off during their first year (4.62 hours for every 80 hours worked) and increased accruals after five years of service.\nPaid training and certifications\nLegal assistance and identity protection\nPet insurance\nEmployee assistance program (EAP)\nTo comply with Pay Transparency laws, employers must disclose an annual salary range. Actual offers depend on factors such as location, experience, skills, and market data. This position may also offer variable compensation.\nPlease contact  if you have any questions related to this job posting.\nQXO is an Equal Opportunity Employer. We value diversity and do not discriminate on the basis of race, color, religion, gender or sexual orientation, national origin, age, disability, or any other protected status.\nPay Range\nUSD $101,300.00 - USD $172,000.00 /Yr.","description_format":"text","description_chars":6313,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Parental leave","Vision insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management","Wholesale","Kitchens, Bathrooms & Home Improvement"],"lifecycle":[{"event":"open","at":"2026-10-14T14:23:13Z"}],"visa":[],"liveness":{"score":27,"band":"fade","label":"Fading","p_open":1,"p_active":0.606,"p_room":0.45,"age_days":15,"expected_fill_days":9,"reasons":["conf:3","velocity","win:tail","comp:junior,brand"],"computed_at":"2026-10-30T05:48:23Z"},"pay":{"stated_usd_annual":172000,"is_top_pay":true},"html_url":"https://alion.io/job/qxo-lead-associate-engineer-identity-and-access-management","json_url":"https://alion.io/job/qxo-lead-associate-engineer-identity-and-access-management.json","meta":{"generated_at":"2026-10-30T10:45:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15559,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2455029},"rest":"https://alion.io/mcp/rest/get_company?id=2455029"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fqxo-lead-associate-engineer-identity-and-access-management"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fqxo-lead-associate-engineer-identity-and-access-management"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fqxo-lead-associate-engineer-identity-and-access-management"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/qxo-lead-associate-engineer-identity-and-access-management\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fqxo-lead-associate-engineer-identity-and-access-management"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2536455}},{"tool":"search_jobs","arguments":{"company":"qxo.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2536455},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}