Cybersecurity Lead, Third-Party Risk Management

Beacon Roofing Supply, Inc; Charlotte (NC); On-site; USD 101,000 - 172,000; Full time

Benefits offered by this job

Annual bonus

401(k) with employer match

Medical, dental, and vision insurance

PTO and holidays

Paid time off during first year

Job summary

QXO is seeking a Cybersecurity Lead Associate — Third-Party Risk Management to own and mature the TPRM program, including day-to-day administration of our security platform. The role focuses on assessing cyber risk from suppliers, vendors, and acquired entities during growth and acquisitions.

You will lead risk assessments, embed cybersecurity in vendor contracts, and report metrics to Cybersecurity leadership, while supporting due diligence for M&A activities.

Qualifications

• 10+ years of experience in cybersecurity or risk management.
• Experience owning an enterprise-level program with multiple stakeholders.
• Familiarity with NIST CSF 2.0 and third-party risk frameworks.
• Experience conducting or reviewing security risk assessments.
• Strong written communication and executive summaries.

Responsibilities

• Own the TPRM program and continuous monitoring.
• Lead SecurityScorecard administration and vendor outreach.
• Conduct security risk assessments for suppliers.
• Embed cybersecurity in contracts and onboarding.
• Track risk posture and metrics for leadership.
• Support due diligence for M&A activity.
• Administer Optro TPRM module and manage data integrity.
• Serve as primary point of contact for module support.

Skills

Cybersecurity

IT risk management

Vendor risk management

NIST CSF 2.0

Risk assessments

Written communication

Enterprise platforms

Job description

QXO is seeking a Cybersecurity Lead Associate — Third-Party Risk Management to own and mature the TPRM program, including day-to-day administration of our security platform. The role focuses on assessing cyber risk from suppliers, vendors, and acquired entities during growth and acquisitions.

You will lead risk assessments, embed cybersecurity in vendor contracts, and report metrics to Cybersecurity leadership, while supporting due diligence for M&A activities.