Cybersecurity Lead Associate — Third-Party Risk Management

This role leads QXO’s Third-Party Risk Management (TPRM) program, overseeing continuous vendor security monitoring and providing technical expertise across Procurement, Legal, and business stakeholders. Based in Charlotte, NC (onsite), you will mature program operations, manage key TPRM platforms, and support enterprise risk reporting to cybersecurity leadership.

Program Ownership and Third-Party Risk Management

You will independently own the cybersecurity TPRM program, including continuous security posture monitoring, supplier due diligence assessments, and support for contract negotiations and redlining. The position also includes administration of multiple supplier risk management platforms and ensuring cybersecurity expectations are reflected throughout the vendor lifecycle.

SecurityScorecard Administration and Optimization

Lead the administration and optimization of QXO’s SecurityScorecard implementation. This includes score monitoring, establishing and refining alerting workflows, and coordinating vendor outreach for issues identified through monitoring.

Security Risk Assessments and Confidentiality Focus

Conduct security risk assessments for both new and existing suppliers with limited oversight. Particular attention is required for vendors that may access Confidential or Highly Confidential QXO data, ensuring risk is identified, documented, and managed appropriately.

Subject Matter Expertise for Contracting and Onboarding

Act as the primary subject matter expert and technical partner with Procurement, Legal, and Business Owners. The role focuses on embedding cybersecurity requirements into contracts and supporting secure vendor onboarding practices.

Reporting, Remediation Tracking, and Metrics

Track and report third-party risk posture, remediation status, and program metrics to Cybersecurity leadership. In addition, the role contributes executive-facing risk documentation, including assessments and summary outputs.

M&A Due Diligence Support

Support due diligence for mergers and acquisitions by evaluating the cyber risk profile of acquisition targets and advising on integration plans.

Optro Third-Party Risk Management (TPRM) Module Administration

Administer and maintain the Optro TPRM module, including workflow configuration, user access, and data integrity across compliance and vendor risk assessments. You will serve as the primary point of contact for Optro TPRM module support, including troubleshooting, coordinating platform updates and enhancements, and providing end-user training.

Required Skills and Qualifications

• 10+ years of experience in cybersecurity, IT risk management, and/or vendor risk management
• Hands-on experience owning an enterprise-level program of significant complexity across multiple stakeholder groups
• Working knowledge of NIST CSF 2.0 and third-party risk frameworks
• Experience conducting or reviewing security risk assessments
• Strong written communication skills for risk assessments and executive-facing summaries
• Experience administering enterprise-level platforms used by diverse stakeholders

Technology Stack

• SecurityScorecard
• NIST CSF 2.0
• Optro Third-Party Risk Management (TPRM)
• Optro

Compensation and Location

• Location: Charlotte, NC (onsite)
• Salary: USD 101,300 - 172,000 per year
• Experience requirement: 10+ years

Benefits

• Annual performance bonus
• 401(k) with employer match
• Medical, dental, and vision insurance
• PTO, company holidays, and parental leave
• Paid Time Off/Paid Sick Leave: accrue 15 days of paid time off during the first year (4.62 hours for every 80 hours worked), with increased accruals after five years of service
• Paid training and certifications
• Legal assistance and identity protection
• Pet insurance
• Employee assistance program (EAP)