Security Program Manager

Security Program Manager Security Services, Cybersecurity & Compliance We are Lennar

Lennar is one of the nation's leading homebuilders, dedicated to making an impact and creating an extraordinary experience for their Homeowners, Communities, and Associates by building quality homes and providing exceptional customer service, giving back to the communities in which we work and live in, and fostering a culture of opportunity and growth for our Associates throughout their career. Lennar has been recognized as a Fortune 500® company and consistently ranked among the top homebuilders in the United States.

Lennar has an opportunity for a Security Program Manager within the Resilience and Security Services organization, working in close partnership with Security, primarily comprised of Governance, Risk, and Compliance (GRC) and Privacy, to run the enterprise program that keeps Lennar's NIST Cybersecurity Framework (CSF) controls backed by clear, current policy and verifiable evidence of adherence. This role reports directly to the Director, Resilience and Security Services.

The Security Program Manager is Lennar's primary point of contact for internal and external audit engagements and regulatory inquiries, and the trusted advisor to the federation of control owners across Lennar IT (LTG) who author and maintain policy. This is a program management role at its core: the Security Program Manager runs the assurance program end-to-end, setting the annual cadence, managing cross-functional work streams, and holding every deliverable, policy review, evidence request, and audit response to a disciplined program plan.

Additional insight into cybersecurity and IT auditing is a major plus.

• A career with purpose.
• A career built on making dreams come true.
• A career built on building zero defect homes, cost management, and adherence to schedules.

• Lead and manage the enterprise assurance program as a structured, multi-workstream initiative, applying disciplined program and project management practices (Agile, Waterfall, or hybrid, as appropriate) to keep every deliverable on time and within scope.
• Build and maintain the year-long assurance calendar, aligning evidence-gathering activity, policy reviews, and audit response with Lennar's regulatory and audit calendars.
• Own the enterprise policy library: maintain an accurate, current inventory of every policy tied to an enforced NIST CSF control, manage the policy lifecycle on an annual review cadence, and read every policy closely for clarity, completeness, and fidelity to the intent of the underlying control.
• Design and maintain the standard process flow that governs how a policy moves from draft through review, giving control owners a clear, repeatable path to a compliant policy. Security retains final review and sign-off authority on every policy; the Security Program Manager ensures the process is followed.
• Own the evidence library: ensure evidence is properly cataloged, stored, and retrievable, and that evidence approaching the end of its one-year validity window is refreshed before it expires.
• Serve as Lennar's primary liaison to internal and external audit teams and regulatory bodies, leading the response to audit and regulatory evidence requests with a service-oriented, no-surprises approach, and reusing previously validated evidence wherever it falls within its one-year validity period.
• Partner directly with control and policy owners across the LTG federation, providing patient, constructive guidance and facilitating solution-oriented working sessions that keep policy work moving ahead of Security's final review.
• Lead the evaluation and selection of the system(s) of record for the policy and evidence libraries, anticipated to be a combination of SharePoint and Audit Board, with final tooling to be determined as an initial program deliverable.
• Identify and help assess security and compliance risks surfacing from policy gaps, control weaknesses, or stale evidence, applying working knowledge of relevant frameworks (NIST CSF, SOC, PCI, FFIEC) to escalat[e?] substantive issues to Security and…