Manager- IT Governance, Risk, and Compliance

UDR Careers•Highlands Ranch, CO

4d•Hybrid

About The Position

UDR is seeking a Manager – IT Governance, Risk, and Compliance (GRC) to lead and strengthen enterprise technology governance, risk management, and compliance programs. The role advances audit readiness, consumer privacy, third-party risk management, IT policy management, and AI and data governance initiatives across the organization. The Manager partners with Information Technology, Cybersecurity, Internal Audit, Legal, external auditors, and business stakeholders to manage compliance requirements, identify and mitigate risk, and align technology practices with regulatory obligations and business objectives. The role leads and develops GRC and Privacy team members and provides reporting and risk insights to IT leadership and the Board of Directors. The position leads the IT SOX audit program, NIST Cybersecurity Framework self-assessments, compliance audits, IT policy management, and GRC reporting. It supports AI governance and data privacy initiatives, oversees consumer privacy requests, and collaborates on data governance practices. The Manager also leads the vendor risk assessment program, coordinates mitigation of vendor risks, and partners with Legal on contractual safeguards. Team responsibilities include setting priorities, reviewing work, coaching employees, and managing performance. The position operates in a standard office environment with a flexible hybrid work schedule, subject to management approval. Occasional evening or weekend work may be required to support business needs.

Requirements

Minimum of eight years of experience working in IT governance, risk, and compliance.
Minimum of five years of experience managing technology-focused programs and projects.
Minimum of three years of experience managing a team within IT GRC, privacy, or IT security.
Demonstrated experience supporting IT SOX controls, external audits, NIST CSF assessments, ISO 27001, or comparable compliance frameworks.
Strong knowledge of U.S. state privacy laws, including CCPA/CPRA, and established vendor risk management practices.
Experience managing cross-functional compliance initiatives, coordinating multiple stakeholders, and translating complex requirements into actionable plans.
Excellent written and verbal communication skills, including the ability to present risk assessments, audit findings, and recommendations to senior leadership.
Strong organizational, analytical, and problem-solving skills, with the ability to manage competing priorities and exercise sound judgment.
Ability to build effective partnerships across IT, Legal, Cybersecurity, Internal Audit, vendors, and business teams.
Proficiency with Microsoft Office and standard reporting, collaboration, and project management tools.

Nice To Haves

Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or a related field preferred; an equivalent combination of education and experience will be considered.
Certifications such as CISA, CRISC, CISSP, CIPP/US, or comparable audit, risk, privacy, or security credentials.
Experience developing and maintaining IT policies, compliance calendars, risk reporting, and executive-level dashboards.
Experience supporting AI governance programs, data privacy initiatives, and emerging technology risk assessments.

Responsibilities

Lead UDR’s IT SOX audit program and serve as the primary management escalation point for external auditors, coordinating quarterly, annual, and ad hoc audit requests.
Direct the annual NIST Cybersecurity Framework (CSF) self-assessment, including scoping, coordinating control owners, identifying gaps, and reporting results to IT leadership.
Develop and implement compliance audits and assessments, including CCPA/CPRA cybersecurity audit and risk assessment requirements.
Maintain and enhance UDR’s IT policy library to address compliance gaps, support ISO 27001 alignment, and meet business and security needs.
Oversee IT policy development, approvals, annual reviews, and exception requests, and recommend policy exceptions to IT leadership.
Manage UDR’s policy management platform and evaluate GRC tools to support compliance requirements.
Maintain the GRC compliance calendar and provide audit status updates, compliance metrics, and risk reporting to executive leadership and the Board of Directors.
Support UDR’s AI governance program by maintaining the AI Acceptable Use Policy, enhancing AI intake requirements, developing risk classification practices, and facilitating AI Governance Committee meetings.
Participate in the AI Council and escalate material AI risks, including fair housing and SEC disclosure considerations, to appropriate IT and Legal leaders.
Oversee data subject access requests (DSARs) and consumer privacy requests across the states where UDR operates, including requests submitted through the “Your Privacy Choices” form.
Guide investigations and resolutions of complex privacy requests, consumer complaints, and incidents while maintaining appropriate evidence handling and chain-of-custody practices.
Monitor emerging state privacy legislation with Legal and Government Affairs and assess impacts to UDR’s privacy program.
Partner with Marketing and Legal on privacy policy updates and annual reviews, website privacy controls, cookie banners, and consent management.
Collaborate with IT on data governance practices, including role-based access control, data classification and tagging, data masking, and row- and column-level security.
Oversee enterprise training and awareness initiatives related to data privacy, AI governance, and GRC compliance.
Lead UDR’s vendor risk assessment (VRA) program, including intake, annual reassessments, program metrics, and reviews for new vendors and recertifications.
Approve routine vendor risk assessment outcomes within established thresholds and recommend non-routine risk decisions to IT leadership.
Communicate vendor risk findings to stakeholders and coordinate vendor discussions to resolve identified concerns.
Partner with Legal on vendor contracting requirements, including Data Security Addenda, mutual nondisclosure agreements, and AI-specific contractual protections.
Help establish contractual safeguards for AI-enabled vendor solutions, including audit rights, bias testing obligations, and incident notification requirements.
Lead, mentor, and develop GRC and Privacy team members, supporting professional growth and career progression.
Establish priorities, assign work, and review deliverables to ensure quality, consistency, and timely completion of team objectives.
Manage team performance, including goal setting, performance reviews, coaching, corrective action, and other personnel decisions as appropriate.
Foster a collaborative and accountable team environment, address employee concerns, and support effective working relationships.

Benefits

Medical, Dental, Vision Plans
Medical Flexible Spending Account
Dependent Care Spending Account
Lifestyle Spending Account
Supplemental Term Life Insurance
Voluntary Cancer Insurance
Supplemental Short-Term Disability Insurance / AD&D Insurance
Voluntary Long Term Care Insurance
401(k) Plan with company match
Eligible for 15% annual bonus potential, based on personal and company performance