Enterprise Security Manager

Avenue5; Phoenix (AZ); Híbrido; USD 140 000 - 190 000; Tempo integral

Resumo da oferta

Avenue5 is seeking an Enterprise Security Manager to lead cybersecurity and physical access programs across its offices nationwide. The role partners with IT, legal, HR, finance and operations to ensure secure, compliant systems and data protection.

You will drive risk assessments, incident response, vulnerability management, IAM, and data privacy while coordinating audits, regulatory requirements, and security reviews with internal and external stakeholders.

Qualificações

• Bachelor's degree in Cybersecurity, IT, CS or related field.
• 5+ years in information security and 2+ years leading security programs.
• Experience with incident response, vulnerability management, IAM/MFA and audit coordination.
• Experience with Microsoft 365/Azure AD (Entra ID), endpoint protection, SIEM, firewalls and cloud security.

Responsabilidades

• Lead cybersecurity risk assessments and governance aligned to frameworks (NIST CSF, CIS Controls, ISO 27001).
• Plan and coordinate internal/external audits, attestations, and security reviews.
• Own incident response playbooks, investigations, containment and recovery.
• Oversee vulnerability management, patching and risk remediation across environments.
• Manage physical and cloud access security, MFA, SSO and privileged access reviews.
• Evaluate supplier security and data protection in third-party contracts.

Conhecimentos

Security governance

Incident response

Vulnerability management

IAM / MFA

Data privacy

Physical access

Security audits

PCI DSS

Formação académica

Bachelor's degree in Cybersecurity/IT or related field

CISSP/CISM/CISA or similar

Ferramentas

Microsoft 365/Azure AD

EDR

SIEM

Firewalls

Descrição da oferta de emprego

About Us

Avenue5 is growing, and we are seeking an enterprise security manager to join our dynamic team of Fivers!

Avenue5 Residential is a third-party multifamily and single-family property management firm managing more than 165,000 apartment homes across 24 states and Washington, D.C. We are proud of our inclusive, make-it-happen culture, where we:

Listen to our associates, recognize them, and give them room to grow

Invest in our associates to help them become the best version of themselves

Approach every important decision with our associates in mind

Celebrate our associates' successes and encourage them to raise the bar even higher

Summary of Responsibilities

The Enterprise Security Manager leads Avenue5's cybersecurity and physical access security programs across the corporate IT environment and offices nationwide and partners with legal on data privacy. This person assesses and reduces risk, leads audits and incident response, and implements security controls that support secure, compliant, and well-governed business technology.

The role partners closely with IT, legal, human resources, finance, and operations leaders. It serves as the company's primary point of contact for security questions, supplier security reviews, and regulatory or client security requirements.

Primary Responsibilities and Objectives

Security Risk Assessment and Governance

Conduct ongoing cybersecurity risk assessments of corporate IT infrastructure, applications, cloud services and endpoints.

Develop, maintain and enforce enterprise security policies, standards and procedures aligned to recognized frameworks (e.g., NIST CSF, CIS Controls, ISO 27001).

Maintain a security risk register; prioritize risks and track remediation plans to completion.

Report on security posture, key risks and program metrics to IT leadership and executives on a regular cadence.

Audits and Compliance

Plan, coordinate and facilitate internal and external security audits, assessments and penetration tests.

Serve as primary liaison to auditors, insurers and clients for security questionnaires and evidence requests.

Track audit findings and drive timely remediation with system owners.

Support compliance with applicable payment security requirements, including PCI DSS where applicable, and cyber insurance conditions; review supplier SOC 2 reports and track identified control gaps.

Incident Response

Own the cybersecurity incident response plan, including playbooks, roles and escalation paths.

Lead investigation, containment, eradication and recovery for security incidents.

Document incidents, root causes and corrective actions; prepare post-incident reports for leadership.

Coordinate with Legal, outside counsel, forensic firms and insurers when needed; run tabletop exercises at least annually.

Vulnerability and Patch Management

Oversee vulnerability scanning across servers, endpoints, network devices and cloud resources.

Ensure operating system, application and firmware patches are applied within defined timeframes.

Research emerging threats and vulnerabilities and recommend remediation.

Track and report patch compliance and exceptions.

Identity and Access Management

Ensure multi-factor authentication (MFA) is enforced across corporate systems, remote access and cloud applications.

Oversee secure user provisioning and deprovisioning tied to HR onboarding, transfers and terminations.

Enforce least privilege access; manage privileged accounts and conduct periodic access reviews.

Partner with IT on single sign-on (SSO) and directory security.

Technology and Supplier Security Review

Evaluate the security of new and existing technology products used for business operations, including property management, accounting, payments and resident-facing platforms.

Review security of integrations with corporate IT infrastructure, including APIs, data feeds and third-party connections.

Conduct third-party risk assessments and review supplier contracts for security and data protection terms.

Recommend security tools and controls; manage relevant security suppliers and budgets.

Data Privacy and Protection

Support the company's data privacy program in partnership with legal, including handling of resident, associate and client personal information.

Help maintain compliance with applicable state privacy and data breach notification laws (e.g., CCPA/CPRA).

Implement data classification, data loss prevention, encryption and retention controls.

Partner with Legal on privacy requests, breach assessments and notifications.

Physical Access Security

Manage secure physical access to corporate and regional offices nationwide, including badge, key card and visitor systems.

Oversee issuing and revoking access credentials in line with onboarding and offboarding.

Coordinate with facilities teams on access control systems, cameras and alarm suppliers.

Review access logs and investigate physical security incidents.

Security Awareness

Lead security awareness training and phishing simulations for associates.

Communicate security guidance and alerts across the organization.

Other Duties

Perform other duties as assigned.

Education and Experience

7+ years of IT experience, including 5+ years focused on information security.

2+ years leading security programs, projects or teams.

Hands-on experience with incident response, vulnerability management, IAM/MFA and audit coordination.

Experience with Microsoft 365/Azure AD (Entra ID), endpoint protection (EDR), SIEM, firewalls and cloud security.

Experience with physical access control systems is a plus.

Property management, real estate or multi-site company experience preferred.

Bachelor's degree in Cybersecurity, Information Technology, Computer Science or a related field, or equivalent experience.

Certifications (one or more preferred)

CISSP, CISM, CISA, CompTIA Security+ / CySA+, or GIAC (e.g., GSEC, GCIH).

Privacy certification such as CIPP/US is a plus.

Skills and Abilities

Strong knowledge of security frameworks (NIST, CIS, ISO 27001), applicable payment security standards (PCI DSS), and supplier assurance reports (SOC 2).

Working knowledge of U.S. data privacy and breach notification laws.

Ability to explain technical risks in plain business terms to executives and non-technical associates.

Excellent documentation, reporting, and project management skills.

Calm, sound judgment under pressure during incidents.

High integrity and discretion with confidential information.

Ability to work across departments and influence without direct authority.

Required to complete and successfully pass the Avenue5 Fair Housing and Preventing Discrimination and Harassment training and other courses if assigned.

Environment

Primarily office-based or remote computer work.

Must be available after hours and on weekends to respond to security incidents.

Travel to offices nationwide, up to 25%

Physical Requirements

Ability to lift, push, and pull up to 25 pounds

Hearing and visual ability to observe and detect signs of emergency required

Must be able to sit, stand, reach, bend, and stoop for extended periods of time

Diversity

Diversity creates a healthier atmosphere: Avenue5 is an Equal Employment Opportunity/Affirmative Action employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, national origin, protected veteran status, disability status, sexual orientation, gender identity or expression, marital status, genetic information, or any other characteristic protected by law.