Senior Manager, Information Security GRC

ABOUT GREYSTAR

Greystar is a leading fully integrated global real estate platform offering expertise in property management investment management development and construction services in institutional-quality rental housing. Headquartered in Charleston South Carolina Greystar manages and operates over $300 billion of real estate in more than 265 markets globally with offices throughout North America Europe South America and the Asia-Pacific region. Greystar is the largest operator of apartments in the United States managing over one million units/beds globally. Across its platforms Greystar has nearly $79 billion of assets under management including over $35 billion of development assets and over $36.5 billion of regulatory assets under management. Greystar was founded by Bob Faith in 1993 to become a provider of world-class service in the rental residential real estate business. To learn more visit .

JOB DESCRIPTION SUMMARY

The Senior Manager Information Security GRC owns the strategy execution and continuous improvement of Greystars Global Information Security Governance Risk and Compliance program. This role builds and leads the GRC function - developing internal team capability and directing third-party partners - and is accountable for the frameworks processes and reporting that govern security risk regulatory compliance third-party risk and security awareness across the enterprise. The Senior Manager sets the GRC program roadmap advises senior leadership on the organizations risk posture and partners across the business to preserve the availability integrity and confidentiality of Greystar and customer information in compliance with applicable information security laws policies and standards. Reports to the Information Security Officer (or CISO).

JOB DESCRIPTION

• Own the GRC program roadmap and strategy setting priorities objectives and maturity goals aligned with business and security objectives.
• Build and lead the GRC function growing internal team capability while directing third-party partners to deliver against program objectives.
• Advise the Information Security Officer and senior leadership on enterprise security risk posture emerging threats and regulatory exposure.
• Establish and report program metrics dashboards and KPIs that communicate GRC program health to senior leadership and the board.

• Own the information security policy framework including development approval enforcement and periodic review of policies standards and procedures for global locations.
• Direct the monitoring of changes in laws regulations and industry standards affecting information security (e.g. NIST ISO 27001 PCI DSS SOX GDPR CCPA) and oversee translation of those changes into actionable business requirements.
• Oversee compliance assessments and maintain the organizations compliance posture across applicable frameworks and regulations.
• Build and mature AI governance practices applying emerging frameworks such as ISO 42001 and the NIST AI RMF.

• Lead the enterprise information security risk management program including risk assessments across business units applications infrastructure and processes; the risk register; and risk treatment planning.
• Drive remediation of identified risks partnering with control owners and holding the program accountable for closure.
• Own the third-party risk management program including pre-contract security due diligence recurring vendor risk reviews the vendor risk inventory and remediation tracking.

• Oversee responses to client regulator and internal audit requests including security questionnaires (SIG CAIQ) evidence collection and findings remediation.
• Direct periodic audits of internal control systems to ensure access levels segregation of duties and configuration baselines remain appropriate and lead the response to audit findings requiring action.
• Oversee periodic user access and privileged access reviews across in-scope systems and applications ensuring timely remediation of inappropriate or excessive access.
• Partner with Legal Privacy and other stakeholders on Electronically Stored Information (ESI) requests including identification preservation collection and chain-of-custody documentation in support of legal holds investigations and regulatory inquiries.

• Own the enterprise security awareness program including training curricula and ongoing awareness communications that promote secure behavior across the organization.
• Oversee the phishing simulation program including campaign strategy results analysis and remediation training.
• Direct administration and enhancement of the enterprise GRC platform including workflow configuration control library maintenance reporting and user support.

• Bachelors degree in Information Security Computer Science Information Systems or a related field or equivalent work experience.
• Eight or more years of progressive experience in information security with at least four years focused on GRC risk audit or compliance.
• Two or more years of direct people-management experience leading security risk or compliance teams.
• Demonstrated experience building operating and maturing an enterprise risk management program including risk assessments risk registers and risk treatment planning.
• Demonstrated experience owning a third-party risk management program including vendor security assessments and due diligence.
• Strong working knowledge of security frameworks and standards including ISO 27001 SOC 2 NIST 800-53 and GDPR.
• Familiarity with cloud environments (AWS GCP Azure) and their risk and compliance implications.
• Familiarity with AI governance concepts and emerging frameworks (ISO 42001 NIST AI RMF) or a demonstrated ability to learn and apply new frameworks quickly.
• Strong analytical and problem-solving skills with the ability to translate technical risk into clear business language for executive audiences.
• Demonstrated ability to lead multiple priorities drive issues to closure and operate with significant autonomy.
• Proven ability to influence partners across IT Engineering Legal Privacy Internal Audit and the business.
• Industry certifications such as CRISC CISA CISSP CISM or CCSK strongly preferred.
• Experience with GRC platforms such as Hyperproof OneTrust Archer or similar.

Experience with security awareness traini

Additional Compensation:

Many factors go into determining employee pay within the posted range including business requirements prior experience current skills and geographical location.

• Corporate Positions:Inaddition to the base salary this role may be eligible to participateina quarterly or annual bonus program based onindividual and company performance.

• Onsite Property Positions:Inaddition to the base salary this role may be eligible to participatein weekly monthly and/or quarterly bonus programs.

Robust Benefits Offered*:

• Competitive Medical Dental Vision and Disability & Lifeinsurance benefits. Low (free basic) employee Medical costs for employee-only coverage; costs discounted after 3 and 5 years of service.

• Generous Paid Time off. All new hires start with 15 days of vacation 4 personal days 10 sick days and 11 paid holidays. Plus your birthday off after 1 year of service! Additional vacation accrued with tenure.

• For onsite team members onsite housing discount at Greystar-managed communities are available subject to discount and unit availability.

• 6-Week Paid Sabbatical after 10 years of service (and every 5 years thereafter).

• 401(k) with Company Match up to 6% of pay after 6 months of service.

• Paid Parental Leave and lifetime Fertility Benefit reimbursement up to $10000 (includes adoption or surrogacy).

• Employee Assistance Program.

• Critical Illness Accident HospitalIndemnity PetInsurance and Legal Plans.

• Charitable giving program and benefits.

*Benefits offered for full-time employees. For Union and Prevailing Wage roles compensation and benefits may vary from the listedinformation above due to Collective Bargaining Agreements and/or local governing authority.

Greystar will consider for employment qualified applicants with arrest and conviction records.

Important Notice: Greystar will never request your banking details or other sensitive personal information during the interview process. Greystar does not conduct any interviews via text or messaging and all communication will come from official Greystar email addresses (@). If you receive suspicious requests please report them immediately to