Enterprise Security Manager

Avenue5 is growing, and we are seeking an enterprise security manager to join our dynamic team of Fivers!

Avenue5 Residential is a third-party multifamily and single-family property management firm managing more than 165,000 apartment homes across 24 states and Washington, D.C. We are proud of our inclusive, make-it-happen culture, where we:

• Listen to our associates, recognize them, and give them room to grow
• Invest in our associates to help them become the best version of themselves
• Approach every important decision with our associates in mind
• Celebrate our associates' successes and encourage them to raise the bar even higher

The Enterprise Security Manager leads Avenue5's cybersecurity and physical access security programs across the corporate IT environment and offices nationwide and partners with legal on data privacy. This person assesses and reduces risk, leads audits and incident response, and implements security controls that support secure, compliant, and well-governed business technology.

The role partners closely with IT, legal, human resources, finance, and operations leaders. It serves as the company's primary point of contact for security questions, supplier security reviews, and regulatory or client security requirements.

• Conduct ongoing cybersecurity risk assessments of corporate IT infrastructure, applications, cloud services and endpoints.
• Develop, maintain and enforce enterprise security policies, standards and procedures aligned to recognized frameworks (e.g., NIST CSF, CIS Controls, ISO 27001).
• Maintain a security risk register; prioritize risks and track remediation plans to completion.
• Report on security posture, key risks and program metrics to IT leadership and executives on a regular cadence.

• Plan, coordinate and facilitate internal and external security audits, assessments and penetration tests.
• Serve as primary liaison to auditors, insurers and clients for security questionnaires and evidence requests.
• Track audit findings and drive timely remediation with system owners.
• Support compliance with applicable payment security requirements, including PCI DSS where applicable, and cyber insurance conditions; review supplier SOC 2 reports and track identified control gaps.

• Own the cybersecurity incident response plan, including playbooks, roles and escalation paths.
• Lead investigation, containment, eradication and recovery for security incidents.
• Document incidents, root causes and corrective actions; prepare post-incident reports for leadership.
• Coordinate with Legal, outside counsel, forensic firms and insurers when needed; run tabletop exercises at least annually.

• Oversee vulnerability scanning across servers, endpoints, network devices and cloud resources.
• Ensure operating system, application and firmware patches are applied within defined time frames.
• Research emerging threats and vulnerabilities and recommend remediation.
• Track and report patch compliance and exceptions.

• Ensure multi-factor authentication (MFA) is enforced across corporate systems, remote access and cloud applications.
• Oversee secure user provisioning and deprovisioning tied to HR onboarding, transfers and terminations.
• Enforce least privilege access; manage privileged accounts and conduct periodic access reviews.
• Partner with IT on single sign-on (SSO) and directory security.

• Evaluate the security of new and existing technology products used for business operations, including property management, accounting, payments and resident-facing platforms.
• Review security of integrations with corporate IT infrastructure, including APIs, data feeds and third-party connections.
• Conduct third-party risk assessments and review supplier contracts for security and data protection terms.
• Recommend security tools and controls; manage relevant security suppliers and budgets.

• Support the company's data privacy program in partnership with legal, including handling of resident, associate and client personal information.
• Help maintain compliance with applicable state privacy and data breach notification laws (e.g., CCPA/CPRA).
• Implement data classification, data loss prevention, encryption and retention controls.
• Partner with Legal on privacy requests, breach assessments and notifications.