Manager, Technology Security and Governance

Core Spaces•Chicago, IL

About The Position

The Manager, Technology Security and Governance will own and mature Core’s technology security, compliance, and governance capabilities. This hands-on leader will translate security and regulatory requirements into practical, auditable controls; administer and oversee critical security processes across the Microsoft environment and key business systems; and drive remediation, governance assessments, third-party risk management, and incident readiness. The role works closely with Technology, Finance, Human Resources, Legal, business leaders, auditors, consultants, and managed service partners to strengthen internal ownership, reduce reliance on external partners, and protect the business while enabling efficient operations. Core Spaces is a vertically integrated real estate investment manager focused on student housing and build-to-rent sectors. Its residential communities combine amenities, design, and hospitality-driven service. The organization emphasizes collaboration, innovation, trust, and improving the resident experience. The role reports to the Vice President, Technology and has no direct reports. Occasional travel may be necessary. The employee must be able to complete the role’s physical requirements with or without reasonable accommodation. Responsibilities and reporting lines may change to meet organizational needs.

Requirements

Bachelor’s degree in cybersecurity, information technology, information systems, risk management, or a related field, or an equivalent combination of education and relevant experience.
Seven or more years of progressive experience in information security, IT governance, technology risk, compliance, or related disciplines, including meaningful ownership of programs, controls, or remediation activities.
Demonstrated success building, maturing, or independently owning security, compliance, or governance capabilities in a growing or changing organization.
Hands-on experience with Microsoft 365 security and administration, including navigating a Microsoft tenant, evaluating policies and configurations, producing reports, investigating activity, and partnering on technical changes; working knowledge of SharePoint governance is required.
Deep experience with identity and access governance, including user access reviews, privileged access, administrator activity, access remediation, and control documentation across enterprise applications.
Experience designing, operating, testing, and remediating IT controls in a SOX-regulated, audit-intensive, or comparably controlled environment, and producing clear, complete, repeatable evidence.
Experience owning third-party technology and security risk processes, including due diligence, risk assessment, issue management, ongoing monitoring, and communication with business and vendor stakeholders.
Sound judgment and analytical ability to evaluate ambiguous security and compliance issues, weigh risk and business impact, determine appropriate action, and escalate material matters effectively.
Strong executive presence, written and verbal communication, facilitation, and change-management skills, including translating complex requirements, building consensus, and influencing leaders without direct authority.
Ability to manage multiple high-priority workstreams independently, establish structure in an evolving environment, meet recurring deadlines, and maintain attention to detail.
Experience directing consultants, contractors, auditors, or managed service providers and holding partners accountable for quality, timeliness, and knowledge transfer.

Nice To Haves

Experience administering ProcessUnity or a comparable governance, risk, compliance, or third-party risk platform.
Experience applying NIST CSF, ITIL, or similar frameworks to create practical security, risk, service-management, and governance processes.
Experience leading incident response planning, tabletop exercises, investigations, and after-action remediation.
Experience developing executive dashboards and risk reporting for audit findings, access governance, third-party risk, control health, and remediation progress.
Experience in a high-growth, mid-sized, or entrepreneurial environment, personally building capabilities and moving between strategic leadership and hands-on execution.
Experience leading people or serving in a security leadership, fractional CISO, security program management, or CISO-adjacent capacity while remaining close to day-to-day operations.
Relevant credentials such as CISM, CISSP, CISA, Security+, Microsoft security certifications, or ITIL certification.

Responsibilities

Own and mature Core’s technology security and governance program through scalable policies, standards, control procedures, decision rights, and operating rhythms aligned with business objectives.
Lead IT compliance and audit readiness by interpreting requirements, designing and documenting auditable controls, coordinating evidence collection and testing, evaluating exceptions, and driving remediation.
Direct enterprise identity and access governance, including user and privileged access reviews, segregation-of-duties considerations, joiner-mover-leaver controls, and remediation across Microsoft, Paycom, Yardi, and other critical platforms.
Provide hands-on oversight of Microsoft 365 and SharePoint administration, security and compliance configurations, policy review, reporting, administrator activity and change-log analysis, and coordination of complex engineering changes.
Own the third-party risk management lifecycle, including vendor intake, tiering, due diligence, security assessments, risk scoring, contract-control input, issue tracking, reassessment, exception management, and executive reporting; administer and enhance supporting tools such as ProcessUnity.
Lead security investigations and control remediation by assessing issues and alerts, determining business impact and required action, coordinating technical response, documenting root causes, and ensuring corrective actions are implemented and sustained.
Advance security framework and risk-management practices using NIST and other relevant standards; identify control gaps, prioritize risk-based improvements, and maintain practical roadmaps.
Strengthen incident response readiness by maintaining plans and escalation paths, coordinating tabletop exercises, supporting response activities, documenting lessons learned, and tracking improvements.
Develop security, compliance, and governance metrics, dashboards, risk narratives, and executive updates covering exposure, control effectiveness, audit status, remediation progress, and decisions requiring leadership attention.
Advise business stakeholders on security matters, translating technical and regulatory requirements into clear recommendations and implementing controls with appropriate rigor and minimal unnecessary friction.
Manage external security relationships and delivery, setting expectations for consultants, contractors, fractional leaders, auditors, and managed service providers; reviewing work quality, resolving dependencies, and transitioning knowledge and responsibilities in-house.
Monitor emerging threats, technology changes, and regulatory expectations; assess relevance to Core and recommend proportionate updates to controls, processes, training, and investment priorities.
Travel occasionally as needed.
Perform other duties and tasks as assigned by management.
Complete all physical requirements of the role with or without reasonable accommodation.

Benefits

Competitive pay that values your contributions.
Incentives designed to reward your achievements.
Paid flexible PTO.
Paid 14+ holidays, including your birthday.
Paid parental leave beginning after 90 days.
Paid volunteer time off.
Robust health plan options beginning within at least 30 days of employment.
Monthly phone reimbursement.
Wellness allowance and perks, including a yearly subscription to a meditation app.
Employee Assistance Program for access to confidential support services.
Company retirement options including 401(k) with matching and a Roth account option.
A culture that provides a sense of belonging.
Monthly workshop weeks with fewer meetings and more collaboration.
An environment that provides employees a voice to share their perspectives.