Enterprise Security Manager

Avenue5 Residential, LLC•Phoenix, AZ

About The Position

The Enterprise Security Manager leads Avenue5's cybersecurity and physical access security programs across the corporate IT environment and offices nationwide, and partners with Legal on data privacy. The role assesses and reduces risk, leads audits and incident response, and implements security controls that support secure, compliant, and well-governed business technology. The manager works closely with IT, Legal, Human Resources, Finance, and Operations leaders and serves as the primary point of contact for security questions, supplier security reviews, and regulatory or client security requirements. Responsibilities include enterprise security risk assessment and governance; audit and compliance coordination; incident response; vulnerability and patch management; identity and access management; technology and supplier security reviews; data privacy and protection; physical access security; and security awareness training. The role also manages relevant security suppliers and budgets, provides security posture and risk reporting, and performs other duties as assigned. The position is primarily office-based or remote computer work, requires availability after hours and on weekends to respond to security incidents, and involves travel to offices nationwide up to 25%. Physical functions include lifting, pushing, and pulling up to 25 pounds; hearing and visual ability to detect signs of emergency; and sitting, standing, reaching, bending, and stooping for extended periods. Reasonable accommodations are available for individuals with disabilities.

Requirements

7+ years of IT experience, including 5+ years focused on information security.
2+ years leading security programs, projects, or teams.
Hands-on experience with incident response, vulnerability management, IAM/MFA, and audit coordination.
Experience with Microsoft 365/Azure AD (Entra ID), endpoint protection (EDR), SIEM, firewalls, and cloud security.
Strong knowledge of security frameworks (NIST, CIS, ISO 27001), applicable payment security standards (PCI DSS), and supplier assurance reports (SOC 2).
Working knowledge of U.S. data privacy and breach notification laws.
Ability to explain technical risks in plain business terms to executives and non-technical associates.
Excellent documentation, reporting, and project management skills.
Calm, sound judgment under pressure during incidents.
High integrity and discretion with confidential information.
Ability to work across departments and influence without direct authority.
Ability to complete required Avenue5 Fair Housing and Preventing Discrimination and Harassment training and other assigned courses.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent experience.

Nice To Haves

Experience with physical access control systems.
Property management, real estate, or multi-site company experience.
One or more certifications preferred: CISSP, CISM, CISA, CompTIA Security+ / CySA+, or GIAC (e.g., GSEC, GCIH).
Privacy certification such as CIPP/US.

Responsibilities

Conduct ongoing cybersecurity risk assessments of corporate IT infrastructure, applications, cloud services, and endpoints.
Develop, maintain, and enforce enterprise security policies, standards, and procedures aligned with recognized frameworks such as NIST CSF, CIS Controls, and ISO 27001.
Maintain a security risk register, prioritize risks, and track remediation plans through completion.
Report security posture, key risks, and program metrics to IT leadership and executives.
Plan, coordinate, and facilitate internal and external security audits, assessments, and penetration tests.
Serve as the primary liaison to auditors, insurers, and clients for security questionnaires and evidence requests.
Track audit findings and drive timely remediation with system owners.
Support applicable payment security requirements, including PCI DSS where applicable, cyber insurance conditions, and review of supplier SOC 2 reports and control gaps.
Own the cybersecurity incident response plan, including playbooks, roles, and escalation paths.
Lead investigation, containment, eradication, and recovery for security incidents.
Document incidents, root causes, and corrective actions, and prepare post-incident reports for leadership.
Coordinate with Legal, outside counsel, forensic firms, and insurers as needed, and run tabletop exercises at least annually.
Oversee vulnerability scanning across servers, endpoints, network devices, and cloud resources.
Ensure operating system, application, and firmware patches are applied within defined timeframes; track and report patch compliance and exceptions.
Research emerging threats and vulnerabilities and recommend remediation.
Enforce MFA across corporate systems, remote access, and cloud applications.
Oversee secure user provisioning and deprovisioning tied to HR onboarding, transfers, and terminations.
Enforce least-privilege access, manage privileged accounts, and conduct periodic access reviews.
Partner with IT on single sign-on and directory security.
Evaluate security of new and existing technology products used for business operations, including property management, accounting, payments, and resident-facing platforms.
Review security of integrations with corporate IT infrastructure, including APIs, data feeds, and third-party connections.
Conduct third-party risk assessments and review supplier contracts for security and data protection terms.
Recommend security tools and controls and manage relevant security suppliers and budgets.
Support the company's data privacy program with Legal, including handling resident, associate, and client personal information.
Help maintain compliance with applicable state privacy and data breach notification laws, including CCPA/CPRA.
Implement data classification, data loss prevention, encryption, and retention controls.
Partner with Legal on privacy requests, breach assessments, and notifications.
Manage secure physical access to corporate and regional offices nationwide, including badge, key card, and visitor systems.
Oversee issuing and revoking access credentials in line with onboarding and offboarding.
Coordinate with facilities teams on access control systems, cameras, and alarm suppliers.
Review access logs and investigate physical security incidents.
Lead security awareness training and phishing simulations for associates and communicate security guidance and alerts across the organization.
Perform other duties as assigned.
Complete and successfully pass Avenue5 Fair Housing and Preventing Discrimination and Harassment training and other assigned courses.