Senior Manager, Cybersecurity Operations

As a Senior Manager, Cybersecurity Operations at QXO , you'll be a key member of the Cybersecurity Team, providing operational leadership and direction for the company's detect and respond capabilities. This role is responsible for leading teams and working directly across multiple disciplines, technical levels, and business groups to ensure the continuous monitoring, threat detection, incident response, and threat intelligence functions that protect QXO's systems and information assets. The senior manager ensures security operations teams execute with excellence, scales detect and respond capabilities and drives continuous improvement of QXO's security posture and incident response maturity.

QXO is a leading distributor and installer of building products serving an $800 billion market. The company’s mission is to modernize the building products industry through advanced technology and a best-in-class customer experience. QXO is North America’s largest distributor and installer of insulation, the second-largest distributor of roofing products, the second-largest publicly traded distributor of lumber and building materials, and the largest distributor of waterproofing products. The company is targeting $50 billion in annual revenue within the decade through accretive acquisitions and organic growth. For more information, visit QXO.com.

What you'll do:

Lead and manage the Security Operations team, including team leadership, daily operations, alert triage, threat intelligence, incident detection and initial response.

Lead incident response coordination, including triage, containment, remediation, and post-incident analysis with appropriate escalation to leadership and stakeholders.

Oversee managed security services (MDR, SIEM, EDR, threat intelligence, etc.) to ensure effective delivery and alignment with QXO's security objectives.

Own detection engineering and threat hunting activities to identify and escalate emerging threats, anomalies, and security incidents affecting QXO.

Manage and develop high-performing cybersecurity analysts, emphasizing career growth, skill development, and retention through people-first leadership.

Build and maintain threat intelligence programs, including tracking threat actors, TTPs, vulnerabilities, and malware trends relevant to QXO.

Author and maintain security operations procedures, runbooks, playbooks, and standard work to ensure consistent and effective threat response.

Prepare detailed incident reports and root cause analyses, documenting containment, remediation, and after-action reports (AARs) to drive continuous improvement.

Develop and execute the detection and response roadmap, identifying capability gaps, recommending technology investments, and guiding maturation efforts.

Openly support the management team and executive leadership during critical security incidents and organizational transitions.

Partner with infrastructure, application security, and IT teams to validate security controls, coordinate remediation efforts, and drive risk mitigation.

Report on security operations metrics, Key Risk Indicators (KRIs), and incident trends to leadership, translating technical findings into business context.

Support security awareness and training initiatives, educating the organization on threats, phishing campaigns, and incident reporting procedures.

Interface with legal, compliance, and risk management teams as needed to support investigations and operations.

Collaborate with procurement and IT to evaluate and implement new detection and response technologies.

Engage with external partners, industry peers, and vendors to stay current on threat landscape, detection technologies, and incident response best practices.

Perform other duties as assigned.

What you'll bring:

Skills and Experience

At least 7+ years’ experience in cybersecurity across detection, incident response, threat intelligence, and security operations.

3 or more years in a management or senior individual contributor role leading or influencing security operations teams.

Deep hands-on expertise in SOC operations, SIEM platforms, EDR tools, and security information and event management.

Expert-level knowledge of incident response methodologies, the Cyber Kill Chain, and intelligence-driven response practices.

Strong background in threat intelligence, threat actor tracking, malware analysis, and Advanced Persistent Threats (APTs).

Experience with digital forensic techniques, log analysis, and network traffic analysis.

Demonstrated ability to lead and motivate technical teams, build cohesion, and foster a strong security culture.

Capability to work effectively with diverse technical and business teams, translating technical issues into business context.

Strong written and verbal communication skills; ability to present technical findings to both technical and executive audiences.

Additional Qualifications

Proven trustworthiness and history of acting with integrity, taking pride in work, seeking to excel, being curious and adaptable, and communicating well.

Results-oriented with strong problem-solving and decision-making skills in high-pressure environments.

Self-starter requiring minimal supervision; capable of working independently and collaboratively as needed.

Education Requirements

Bachelor's degree in computer science, information assurance, MIS, or related field, or equivalent professional experience.

Certification Requirements

Preferable, but not required: SANS GIAC certification, CISSP or equivalent.

What you'll earn

Base pay range: $140,400 - $210,600

Annual performance bonus

Long term incentive (equity/stock)

401(k) with employer match

Medical, dental, and vision insurance

PTO, company holidays, and parental leave

Paid Time Off/Paid Sick Leave: Applicants can expect to accrue 15 days of paid time off during their first year (4.62 hours for every 80 hours worked) and increased accruals after five years of service.

Paid training and certifications

Legal assistance and identity protection

Pet insurance

Employee assistance program (EAP)

To comply with Pay Transparency laws, employers must disclose an annual salary range. Actual offers depend on factors such as location, experience, skills, and market data. This position may also offer variable compensation.

Please contact careers@QXO.com if you have any questions related to this job posting.

QXO is an Equal Opportunity Employer. We value diversity and do not discriminate on the basis of race, color, religion, gender or sexual orientation , national origin, age, disability, or any other protected status.

Salary Range:

USD $140,400.00 - USD $210,600.00 /Yr.

Lead and manage the Security Operations team, including team leadership, daily operations, alert triage, threat intelligence, incident detection and initial response.

Lead incident response coordination, including triage, containment, remediation, and post-incident analysis with appropriate escalation to leadership and stakeholders.

Oversee managed security services (MDR, SIEM, EDR, threat intelligence, etc.) to ensure effective delivery and alignment with QXO's security objectives.

Own detection engineering and threat hunting activities to identify and escalate emerging threats, anomalies, and security incidents affecting QXO.

Manage and develop high-performing cybersecurity analysts, emphasizing career growth, skill development, and retention through people-first leadership.

Build and maintain threat intelligence programs, including tracking threat actors, TTPs, vulnerabilities, and malware trends relevant to QXO.

Author and maintain security operations procedures, runbooks, playbooks, and standard work to ensure consistent and effective threat response.

Prepare detailed incident reports and root cause analyses, documenting containment, remediation, and after-action reports (AARs) to drive continuous improvement.

Develop and execute the detection and response roadmap, identifying capability gaps, recommending technology investments, and guiding maturation efforts.

Openly support the management team and executive leadership during critical security incidents and organizational transitions.

Partner with infrastructure, application security, and IT teams to validate security controls, coordinate remediation efforts, and drive risk mitigation.

Report on security operations metrics, Key Risk Indicators (KRIs), and incident trends to leadership, translating technical findings into business context.

Support security awareness and training initiatives, educating the organization on threats, phishing campaigns, and incident reporting procedures.

Interface with legal, compliance, and risk management teams as needed to support investigations and operations.

Collaborate with procurement and IT to evaluate and implement new detection and response technologies.

Engage with external partners, industry peers, and vendors to stay current on threat landscape, detection technologies, and incident response best practices.

Perform other duties as assigned.

Skills and Experience

At least 7+ years’ experience in cybersecurity across detection, incident response, threat intelligence, and security operations.

3 or more years in a management or senior individual contributor role leading or influencing security operations teams.

Deep hands-on expertise in SOC operations, SIEM platforms, EDR tools, and security information and event management.

Expert-level knowledge of incident response methodologies, the Cyber Kill Chain, and intelligence-driven response practices.

Strong background in threat intelligence, threat actor tracking, malware analysis, and Advanced Persistent Threats (APTs).

Experience with digital forensic techniques, log analysis, and network traffic analysis.

Demonstrated ability to lead and motivate technical teams, build cohesion, and foster a strong security culture.

Capability to work effectively with diverse technical and business teams, translating technical issues into business context.

Strong written and verbal communication skills; ability to present technical findings to both technical and executive audiences.

Additional Qualifications

Proven trustworthiness and history of acting with integrity, taking pride in work, seeking to excel, being curious and adaptable, and communicating well.

Results-oriented with strong problem-solving and decision-making skills in high-pressure environments.

Self-starter requiring minimal supervision; capable of working independently and collaboratively as needed.

Education Requirements

Bachelor's degree in computer science, information assurance, MIS, or related field, or equivalent professional experience.

Certification Requirements

Preferable, but not required: SANS GIAC certification, CISSP or equivalent.