Enterprise Security Manager

Avenue5 is growing, and we are seeking an enterprise security manager to join our dynamic team of Fivers!

Avenue5 Residential is a third-party multifamily and single-family property management firm managing more than 165,000 apartment homes across 24 states and Washington, D.C. We are proud of our inclusive, make-it-happen culture, where we:

•      Listen to our associates, recognize them, and give them room to grow

•      Invest in our associates to help them become the best version of themselves

•      Approach every important decision with our associates in mind

•      Celebrate our associates' successes and encourage them to raise the bar even higher

The Enterprise Security Manager leads Avenue5's cybersecurity and physical access security programs across the corporate IT environment and offices nationwide and partners with legal on data privacy. This person assesses and reduces risk, leads audits and incident response, and implements security controls that support secure, compliant, and well-governed business technology.

The role partners closely with IT, legal, human resources, finance, and operations leaders. It serves as the company's primary point of contact for security questions, supplier security reviews, and regulatory or client security requirements.

•      Conduct ongoing cybersecurity risk assessments of corporate IT infrastructure, applications, cloud services and endpoints.

•      Develop, maintain and enforce enterprise security policies, standards and procedures aligned to recognized frameworks (e.g., NIST CSF, CIS Controls, ISO 27001).

•      Maintain a security risk register; prioritize risks and track remediation plans to completion.

•      Report on security posture, key risks and program metrics to IT leadership and executives on a regular cadence.

•      Plan, coordinate and facilitate internal and external security audits, assessments and penetration tests.

•      Serve as primary liaison to auditors, insurers and clients for security questionnaires and evidence requests.

•      Track audit findings and drive timely remediation with system owners.

•      Support compliance with applicable payment security requirements, including PCI DSS where applicable, and cyber insurance conditions; review supplier SOC 2 reports and track identified control gaps.

•      Own the cybersecurity incident response plan, including playbooks, roles and escalation paths.

•      Lead investigation, containment, eradication and recovery for security incidents.

•      Document incidents, root causes and corrective actions; prepare post-incident reports for leadership.

•      Coordinate with Legal, outside counsel, forensic firms and insurers when needed; run tabletop exercises at least annually.

•      Oversee vulnerability scanning across servers, endpoints, network devices and cloud resources.

•      Ensure operating system, application and firmware patches are applied within defined timeframes.

•      Research emerging threats and vulnerabilities and recommend remediation.

•      Track and report patch compliance and exceptions.

•      Ensure multi-factor authentication (MFA) is enforced across corporate systems, remote access and cloud applications.

•      Oversee secure user provisioning and deprovisioning tied to HR onboarding, transfers and terminations.

•      Enforce least privilege access; manage privileged accounts and conduct periodic access reviews.

•      Partner with IT on single sign-on (SSO) and directory security.

•      Evaluate the security of new and existing technology products used for business operations, including property management, accounting, payments and resident-facing platforms.

•      Review security of integrations with corporate IT infrastructure, including APIs, data feeds and third-party connections.

•      Conduct third-party risk assessments and review supplier contracts for security and data protection terms.

•      Recommend security tools and controls; manage relevant security suppliers and budgets.

•      Support the company's data privacy program in partnership with legal, including handling of resident, associate and client personal information.

•      Help maintain compliance with applicable state privacy and data breach notification laws (e.g., CCPA/CPRA).

•      Implement data classification, data loss prevention, encryption and retention controls.

•      Partner with Legal on privacy requests, breach assessments and notifications.

•      Manage secure physical access to corporate and regional offices nationwide, including badge, key card and visitor systems.

•      Oversee issuing and revoking access credentials in line with onboarding and offboarding.

•      Coordinate with facilities teams on access control systems, cameras and alarm suppliers.

•      Review access logs and investigate physical security incidents.

•      Lead security awareness training and phishing simulations for associates.

•      Communicate security guidance and alerts across the organization.

•      Perform other duties as assigned.

•      7+ years of IT experience, including 5+ years focused on information security.

•      2+ years leading security programs, projects or teams.

•      Hands-on experience with incident response, vulnerability management, IAM/MFA and audit coordination.

•      Experience with Microsoft 365/Azure AD (Entra ID), endpoint protection (EDR), SIEM, firewalls and cloud security.

•      Experience with physical access control systems is a plus.

•      Property management, real estate or multi-site company experience preferred.

•      Bachelor's degree in Cybersecurity, Information Technology, Computer Science or a related field, or equivalent experience.

•      CISSP, CISM, CISA, CompTIA Security+ / CySA+, or GIAC (e.g., GSEC, GCIH).

•      Privacy certification such as CIPP/US is a plus.

•      Strong knowledge of security frameworks (NIST, CIS, ISO 27001), applicable payment security standards (PCI DSS), and supplier assurance reports (SOC 2).

•      Working knowledge of U.S. data privacy and breach notification laws.

•      Ability to explain technical risks in plain business terms to executives and non-technical associates.

•      Excellent documentation, reporting, and project management skills.

•      Calm, sound judgment under pressure during incidents.

•      High integrity and discretion with confidential information.

•      Ability to work across departments and influence without direct authority.

•      Required to complete and successfully pass the Avenue5 Fair Housing and Preventing Discrimination and Harassment training and other courses if assigned.

•      Primarily office-based or remote computer work.

•      Must be available after hours and on weekends to respond to security incidents.

•      Travel to offices nationwide, up to 25%

Physical Requirements

Avenue5 will make reasonable accommodations to enable individuals with disabilities to perform essential functions. These functions include, but are not limited to:

•     Ability to lift, push, and pull up to 25 pounds

•     Hearing and visual ability to observe and detect signs of emergency required

•     Must be able to sit, stand, reach, bend, and stoop for extended periods of time

Diversity

Diversity creates a healthier atmosphere: Avenue5 is an Equal Employment Opportunity/Affirmative Action employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, age, national origin, protected veteran status, disability status, sexual orientation, gender identity or expression, marital status, genetic information, or any other characteristic protected by law.