Lead App Security Engineer, Code-to-Cloud

Beacon Roofing Supply, Inc; Vancouver (WA); On-site; USD 101,000 - 172,000; Full time

Job summary

QXO is building a modern cybersecurity function from the ground up, automation-first, and you will own the engineering behind Code to Cloud: continuous security coverage across the software delivery lifecycle, from source code through pipeline execution to cloud runtime.

You will drive policy-based blocking in PRs and CI/CD, shape security standards, and mentor engineers across three engineering organizations.

Qualifications

• 8+ years in application security or DevSecOps with hands-on work.
• Experience owning an enterprise-scale security program across multiple teams.
• Written policy and API-based security controls; not just dashboards.

Responsibilities

• Own scanning and posture platform end-to-end across SAST/SCA/IAAC and cloud runtime.
• Build policy-based blocking in PRs and CI/CD with a risk-based gating.
• Define security standards, risk-acceptance workflows, and threat modeling templates.
• Participate in architecture reviews on authorization and service identity.
• Coach security champions, mentor engineers, and mentor third-party testing partners.
• Oversee security testing of running apps and respond to critical vulnerabilities.

Skills

Security program ownership

Cloud-native security

Policy-as-code

Threat modeling

Architecture review

DAST/API security testing

Python/Go/TypeScript

AI-assisted triage

Education

Bachelor’s in CS/InfoSec

Tools

Wiz

Snyk

Prisma Cloud

Orca

Job description

QXO is building a modern cybersecurity function from the ground up, automation-first, and you will own the engineering behind Code to Cloud: continuous security coverage across the software delivery lifecycle, from source code through pipeline execution to cloud runtime.

You will drive policy-based blocking in PRs and CI/CD, shape security standards, and mentor engineers across three engineering organizations.