> Markdown version of [/jobs/ext/4639870-manager-enterprise-application-security-controls](https://www.wearedevelopers.com/jobs/ext/4639870-manager-enterprise-application-security-controls). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Manager, Enterprise Application Security & Controls

- **Company:** QXO Inc
- **Location:** Seattle, WA, United States
- **Experience:** Experienced
- **Salary:** $101,070 - $202,200
- **Contract:** Permanent contract
- **Skills:** Microsoft Access, Application Programming Interfaces (APIs), Application Integration Architecture, Cloud Computing, Cloud Computing Security, Cyber Security, Data Security, Middleware, Identity and Access Management, Oracle (Applications), Role-Based Access Control, Single Sign-On, Oracle Fusion Middleware, Data Streaming, Systems Integration, Enterprise Software Applications, IT General Controls (ITGC), Software Security, Oracle Cloud Infrastructure, User Administration
- **Published:** November 8, 2026
- **Apply:** https://www.seattlejobs.com/job.asp?id=3505242247&tx=FR2724FFG&pt=1&aff=0B19D771-A501-4A5E-8338-2A822B784D54&utm_source=Job%20Feed&utm_medium=textkernel&utm_campaign=DE&utm_term=0B19D771-A501-4A5E-8338-2A822B784D54

## About the Role

* 7+ years of experience in enterprise application security, identity and access management, IT controls, risk management, audit, or related technology roles.
 * 3+ years of hands-on experience with Oracle Fusion Cloud security, including role design, user administration, data access, security configuration, and production support.
 * 3+ years of prior people leadership experience directly managing a team responsible for application security, controls, access governance, or compliance operations, including hiring, performance management, and staff development.
 * Demonstrated experience managing contractors, consultants, and outsourced service providers, including scoping work, overseeing statements of work, directing delivery, and holding partners accountable for quality, timelines, and cost.
 * Deep understanding of Oracle Fusion Cloud security concepts, including abstract, job, duty, and data roles; privileges; role hierarchies; and data access assignments.
 * Experience applying security and controls practices across multiple enterprise applications, with the ability to quickly learn the security models of new platforms.
 * Strong knowledge of segregation of duties, least privilege, privileged-access governance, user access reviews, and joiner-mover-leaver controls.
 * Experience designing, operating, testing, and remediating SOX, IT general controls, and application controls in a complex enterprise environment.
 * Experience supporting internal and external audits, responding to evidence requests, evaluating findings, and driving sustainable corrective actions.
 * Working knowledge of identity lifecycle integrations, single sign-on, APIs, middleware, service accounts, and security dependencies across connected enterprise applications.
 * Experience supporting implementations and releases through requirements, security design, configuration, testing, cutover, hypercare, change control, and production stabilization.
 * Excellent leadership, communication, and judgment, with the ability to translate complex security and control requirements into practical decisions and accountable action plans.
 * Experience with Oracle Risk Management Cloud, Advanced Access Controls, Advanced Financial Controls, or a comparable governance, risk, and compliance platform.
 * Experience with identity governance and administration (IGA) tools used to manage access and certifications across multiple applications.
 * Experience bringing acquired or newly adopted applications into a common security and controls framework.
 * Experience supporting a multi-business-unit, multi-country, acquisition-oriented, or branch-based operating environment.
 * Oracle Cloud security certification, CISA, CISSP, CRISC, or another relevant security, risk, or audit credential.
 * Travel will be required to support implementation, audit, business engagement, rollout, and operational stabilization activities.

## Description

The manager will lead role architecture, user access governance, segregation of duties, privileged access, IT general controls, audit support, and security operations. The role partners closely with Enterprise Applications, Cybersecurity, Internal Audit, Finance, Human Resources, business process owners, Engineering, and external support partners to protect QXO's systems while enabling efficient business operations. As QXO grows through acquisitions and adds new platforms, this role is expected to evolve, taking on a broader portfolio of applications and a more consistent, enterprise-wide security and controls framework., * Lead, develop, and manage a blended team of employees, contractors, and consultants delivering application security and controls services, establishing clear ownership, service expectations, cross-training, documentation, and succession coverage.

 * Own people management for direct reports, including hiring, onboarding, goal setting, performance management, coaching, career development, and recognition.
 * Manage contractors and consultants end to end, including defining resource needs, scoping work and statements of work, onboarding and access, directing day-to-day work, reviewing deliverables, and managing performance and offboarding.
 * Plan team capacity and resourcing, balancing employee, contractor, and consultant staffing against project demand, operational support needs, and budget.
 * Own Oracle Fusion Cloud security architecture and role design, including job roles, duty roles, privileges, data roles, data access, and role hierarchies across enterprise application environments.
 * Extend security and controls standards, role design principles, and governance practices to connected enterprise and boundary systems, building a consistent framework that scales as new applications are added.
 * Establish and enforce role-based access and least-privilege standards that balance business usability, operational support, security requirements, and audit expectations.
 * Manage the end-to-end user access lifecycle across in-scope applications, including onboarding, transfers, terminations, access requests, approvals, provisioning, deprovisioning, periodic access reviews, and exception handling.
 * Lead segregation-of-duties governance within and across applications, including conflict-rule design, preventive and detective analysis, remediation, mitigating controls, documentation, and ongoing monitoring.
 * Own security-related IT general controls and application controls, including control design, evidence collection, operating effectiveness, deficiency remediation, and support for internal and external audits.
 * Govern privileged access, emergency access, service accounts, integration accounts, and other non-person user access, with appropriate approval, monitoring, credential ownership, and periodic recertification.
 * Assess and govern security across application integrations and data flows, including interface accounts, API access, middleware, and controls over data moving between Oracle and connected systems.
 * Partner with Enterprise Applications leaders and business process owners to review security requirements and controls for configurations, new capabilities, quarterly updates, integrations, releases, and production changes.
 * Provide security and controls leadership for implementations, rollout waves, acquisitions, and business integrations, including fit-gap analysis, role mapping, access conversion, testing, cutover, and post-go-live stabilization.
 * Assess the security and controls posture of applications brought in through acquisitions and new platform adoption, and define the path to align them with QXO standards.
 * Coordinate with Cybersecurity, Identity and Access Management, Human Resources, Engineering, and application teams to maintain reliable identity data, automated provisioning, single sign-on, and appropriate access across connected systems.
 * Lead security testing and validation across environments, including role testing, negative testing, access reconciliation, production-readiness reviews, and validation following environment refreshes or major releases.
 * Own production support outcomes for application security and controls, including incident response, access issues, root cause analysis, escalation management, corrective actions, and service-level performance.
 * Manage application security vendors, consulting firms, and AMS partners, including contract and statement-of-work oversight and spend tracking, ensuring clear accountability, effective knowledge transfer, quality delivery, and compliance with QXO security and change-management standards.
 * Define and monitor security and controls measures such as provisioning timeliness, termination compliance, unresolved access conflicts, privileged-access exceptions, access-review completion, audit findings, and support backlog aging.