Manager- IT Governance, Risk, and Compliance

• Posted on October 29, 2026

Showing 1 location Highlands Ranch, CO 80129, USA

• On-site
• Management
• Full-Time
• Requisition #: MANAG
  005824

UDR is seeking a Manager – IT Governance, Risk, and Compliance (GRC) to lead and strengthen our enterprise technology governance, risk management, and compliance programs. This role is responsible for advancing audit readiness, consumer privacy, third-party risk management, IT policy management, and AI and data governance initiatives across the organization.

The Manager will partner closely with Information Technology, Cybersecurity, Internal Audit, Legal, external auditors, and business stakeholders to manage compliance requirements, identify and mitigate risk, and ensure our technology practices align with regulatory obligations and business objectives. This position will also lead and develop GRC and Privacy team members while providing meaningful reporting and risk insights to IT leadership and the Board of Directors.

• Lead UDR’s IT SOX audit program and serve as the primary management escalation point for external auditors, coordinating quarterly, annual, and ad hoc audit requests.

• Direct the annual NIST Cybersecurity Framework (CSF) self-assessment, including scoping, coordinating control owners, identifying gaps, and reporting results to IT leadership.

• Develop and implement new compliance audits and assessments, including CCPA/CPRA cybersecurity audit and risk assessment requirements.

• Maintain and enhance UDR’s IT policy library to address compliance gaps, support ISO 27001 alignment, and meet evolving business and security needs.

• Oversee IT policy development, approvals, annual reviews, and exception requests, providing recommendations to IT leadership on policy exceptions.

• Manage UDR’s policy management platform and evaluate GRC tools to support current and emerging compliance requirements.

• Maintain the GRC compliance calendar and deliver audit status updates, compliance metrics, and risk reporting for executive leadership and the Board of Directors.

• Support UDR’s AI governance program by maintaining the AI Acceptable Use Policy, enhancing AI intake requirements, developing risk classification practices, and facilitating AI Governance Committee meetings.

• Participate in the AI Council and escalation of material AI risks, including fair housing and SEC disclosure considerations, to the appropriate IT and Legal leaders.

• Oversee data subject access requests (DSARs) and consumer privacy requests across the states where UDR operates, including requests submitted through the “Your Privacy Choices” form.

• Guide the investigation and resolution of complex privacy requests, consumer complaints, and incidents, maintaining appropriate evidence handling and chain-of-custody practices.

• Monitor emerging state privacy legislation in partnership with Legal and Government Affairs and assess impacts to UDR’s privacy program.

• Partner with Marketing and Legal on privacy policy updates, annual reviews, website privacy controls, cookie banners, and consent management.

• Collaborate with IT on data governance practices, including role-based access control, data classification and tagging, data masking, and row- and column-level security.

• Oversee enterprise training and awareness initiatives related to data privacy, AI governance, and GRC compliance.

• Lead UDR’s vendor risk assessment (VRA) program, including intake, annual reassessments, program metrics, and review of assessments for new vendors and recertifications.

• Approve routine vendor risk assessment outcomes within established thresholds and recommend non-routine risk decisions to IT…