Enterprise Security Manager

Avenue5 Residential•Phoenix, AZ

About The Position

Avenue5 Residential is a third-party multifamily and single-family property management firm managing more than 165,000 apartment homes across 24 states and Washington, D.C. The Enterprise Security Manager leads the company’s cybersecurity and physical access security programs across its corporate IT environment and nationwide offices, and partners with Legal on data privacy. The role assesses and reduces risk, leads audits and incident response, and implements security controls that support secure, compliant, and well-governed business technology. It works closely with IT, Legal, Human Resources, Finance, and Operations leaders and serves as the company’s primary point of contact for security questions, supplier security reviews, and regulatory or client security requirements. The manager oversees security risk assessment and governance; audits and compliance; incident response; vulnerability and patch management; identity and access management; technology and supplier security reviews; data privacy and protection; physical access security; and security awareness. The position is primarily office-based or remote computer work, requires availability after hours and on weekends for security incidents, and involves travel to offices nationwide up to 25%.

Requirements

At least 7 years of IT experience, including at least 5 years focused on information security.
At least 2 years leading security programs, projects, or teams.
Hands-on experience with incident response, vulnerability management, identity and access management, multi-factor authentication, and audit coordination.
Experience with Microsoft 365/Azure AD (Entra ID), endpoint protection (EDR), SIEM, firewalls, and cloud security.
Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent experience.
Strong knowledge of security frameworks including NIST, CIS, and ISO 27001; PCI DSS; and supplier assurance reports such as SOC 2.
Working knowledge of U.S. data privacy and breach notification laws.
Ability to explain technical risks in plain business terms to executives and non-technical associates.
Excellent documentation, reporting, and project management skills.
Calm, sound judgment under pressure during incidents.
High integrity and discretion with confidential information.
Ability to work across departments and influence without direct authority.
Must complete and successfully pass Avenue5 Fair Housing and Preventing Discrimination and Harassment training and other assigned courses.
Must be available after hours and on weekends to respond to security incidents.
Ability to travel to offices nationwide, up to 25%.
Ability to lift, push, and pull up to 25 pounds.
Hearing and visual ability to observe and detect signs of emergency.
Ability to sit, stand, reach, bend, and stoop for extended periods.

Nice To Haves

Experience with physical access control systems.
Experience in property management, real estate, or a multi-site company.
One or more preferred certifications: CISSP, CISM, CISA, CompTIA Security+ or CySA+, or GIAC certifications such as GSEC or GCIH.
Privacy certification such as CIPP/US.

Responsibilities

Conduct ongoing cybersecurity risk assessments of corporate IT infrastructure, applications, cloud services, and endpoints.
Develop, maintain, and enforce enterprise security policies, standards, and procedures aligned with recognized frameworks such as NIST CSF, CIS Controls, and ISO 27001.
Maintain a security risk register, prioritize risks, and track remediation plans to completion.
Regularly report security posture, key risks, and program metrics to IT leadership and executives.
Plan, coordinate, and facilitate internal and external security audits, assessments, and penetration tests.
Act as the primary liaison to auditors, insurers, and clients for security questionnaires and evidence requests.
Track audit findings and drive timely remediation with system owners.
Support applicable payment security requirements, including PCI DSS where applicable, and cyber insurance conditions; review supplier SOC 2 reports and track control gaps.
Own the cybersecurity incident response plan, including playbooks, roles, and escalation paths.
Lead investigation, containment, eradication, and recovery for security incidents; document incidents, root causes, and corrective actions and prepare post-incident reports.
Coordinate with Legal, outside counsel, forensic firms, and insurers when needed, and run tabletop exercises at least annually.
Oversee vulnerability scanning across servers, endpoints, network devices, and cloud resources.
Ensure operating system, application, and firmware patches are applied within defined timeframes; research emerging threats and vulnerabilities and recommend remediation.
Track and report patch compliance and exceptions.
Ensure multi-factor authentication is enforced across corporate systems, remote access, and cloud applications.
Oversee secure user provisioning and deprovisioning for HR onboarding, transfers, and terminations; enforce least-privilege access, manage privileged accounts, and conduct periodic access reviews.
Partner with IT on single sign-on and directory security.
Evaluate the security of new and existing technology products used for business operations, including property management, accounting, payments, and resident-facing platforms.
Review integrations with corporate IT infrastructure, including APIs, data feeds, and third-party connections.
Conduct third-party risk assessments and review supplier contracts for security and data protection terms.
Recommend security tools and controls and manage relevant security suppliers and budgets.
Support the company’s data privacy program with Legal, including protection of resident, associate, and client personal information.
Help maintain compliance with applicable state privacy and data breach notification laws, including CCPA/CPRA.
Implement data classification, data loss prevention, encryption, and retention controls.
Partner with Legal on privacy requests, breach assessments, and notifications.
Manage secure physical access to corporate and regional offices nationwide, including badge, key card, and visitor systems.
Oversee issuing and revoking access credentials in line with onboarding and offboarding.
Coordinate with facilities teams on access control systems, cameras, and alarm suppliers.
Review access logs and investigate physical security incidents.
Lead security awareness training and phishing simulations for associates.
Communicate security guidance and alerts across the organization.
Perform other duties as assigned.