Lead Code-to-Cloud Application Security Engineer

QXO; Vancouver (WA); On-site; USD 101,000 - 172,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

PTO and holidays

401(k) with employer match

Job summary

QXO is building a modern cybersecurity function and seeks a Lead Application Security Engineer to own Code to Cloud: continuous security coverage across the software delivery lifecycle. You will automate scanning, set policy controls in CI/CD, and drive risk-directed remediation.

You’ll collaborate with principal engineers in architecture reviews, mentor security champions, and lead testing of running apps in a cloud-first environment. This is a high-impact role with equal opportunity.

Qualifications

• 8+ years in application security or DevSecOps.
• Hands-on with enterprise-scale security programs across multiple teams.
• Experience with policy-based blocking in CI/CD pipelines.
• Ability to coach and mentor security engineers.

Responsibilities

• Own end-to-end security platform across SAST, SCA, IaC, and cloud runtime.
• Build policy-based blocking in PRs and CI/CD, with policy-as-code.
• Define security standards and risk-acceptance workflows.
• Lead architecture reviews on authorization and trust boundaries.
• Mentor engineers, coordinate with testing partners, and drive triage.
• Lead security testing of running applications and respond to incidents.

Skills

Application security

DevSecOps

Policy-as-code

Threat modeling

Cloud security

Python/Go/TypeScript

Education

Bachelor’s in computer science or equivalent practical experience

Google Cloud certifications preferred (e.g., Professional Cloud Security Engineer)

Tools

Wiz

Snyk

Prisma Cloud

Orca

Job description

QXO is building a modern cybersecurity function and seeks a Lead Application Security Engineer to own Code to Cloud: continuous security coverage across the software delivery lifecycle. You will automate scanning, set policy controls in CI/CD, and drive risk-directed remediation.

You’ll collaborate with principal engineers in architecture reviews, mentor security champions, and lead testing of running apps in a cloud-first environment. This is a high-impact role with equal opportunity.