> Markdown version of [/jobs/ext/1780244-senior-manager-information-security-grc](https://www.wearedevelopers.com/jobs/ext/1780244-senior-manager-information-security-grc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Manager, Information Security GRC - **Company:** Greystar Real Estate Partners, LLC - **Location:** Southlake, TX, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Microsoft Azure, Cyber Security, Information Systems, Information Security Management, PCI Data Security Standards, Phishing, Simulation Software, Google Cloud, Cloud Platform System, Information Technology, RSA Archer Platform - **Published:** July 2, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=bded361f54144eff ## About the Role * Bachelor's degree in Information Security, Computer Science, Information Systems, or a related field, or equivalent work experience. * Eight or more years of progressive experience in information security, with at least four years focused on GRC, risk, audit, or compliance. * Two or more years of direct people-management experience leading security, risk, or compliance teams. * Demonstrated experience building, operating, and maturing an enterprise risk management program, including risk assessments, risk registers, and risk treatment planning. * Demonstrated experience owning a third-party risk management program, including vendor security assessments and due diligence. * Strong working knowledge of security frameworks and standards including ISO 27001, SOC 2, NIST 800-53, and GDPR. * Familiarity with cloud environments (AWS, GCP, Azure) and their risk and compliance implications. * Familiarity with AI governance concepts and emerging frameworks (ISO 42001, NIST AI RMF), or a demonstrated ability to learn and apply new frameworks quickly. * Strong analytical and problem-solving skills with the ability to translate technical risk into clear business language for executive audiences. * Demonstrated ability to lead multiple priorities, drive issues to closure, and operate with significant autonomy. * Proven ability to influence partners across IT, Engineering, Legal, Privacy, Internal Audit, and the business. * Industry certifications such as CRISC, CISA, CISSP, CISM, or CCSK strongly preferred. * Experience with GRC platforms such as Hyperproof, OneTrust, Archer, or similar. Experience with security awareness traini ## Description The Senior Manager, Information Security GRC owns the strategy, execution, and continuous improvement of Greystar's Global Information Security Governance, Risk, and Compliance program. This role builds and leads the GRC function - developing internal team capability and directing third-party partners - and is accountable for the frameworks, processes, and reporting that govern security risk, regulatory compliance, third-party risk, and security awareness across the enterprise. The Senior Manager sets the GRC program roadmap, advises senior leadership on the organization's risk posture, and partners across the business to preserve the availability, integrity, and confidentiality of Greystar and customer information in compliance with applicable information security laws, policies, and standards. Reports to the Information Security Officer (or CISO)., * Own the GRC program roadmap and strategy, setting priorities, objectives, and maturity goals aligned with business and security objectives. * Build and lead the GRC function, growing internal team capability while directing third-party partners to deliver against program objectives. * Advise the Information Security Officer and senior leadership on enterprise security risk posture, emerging threats, and regulatory exposure. * Establish and report program metrics, dashboards, and KPIs that communicate GRC program health to senior leadership and the board. Governance and Compliance * Own the information security policy framework, including development, approval, enforcement, and periodic review of policies, standards, and procedures for global locations. * Direct the monitoring of changes in laws, regulations, and industry standards affecting information security (e.g., NIST, ISO 27001, PCI DSS, SOX, GDPR, CCPA), and oversee translation of those changes into actionable business requirements. * Oversee compliance assessments and maintain the organization's compliance posture across applicable frameworks and regulations. * Build and mature AI governance practices, applying emerging frameworks such as ISO 42001 and the NIST AI RMF. Risk Management * Lead the enterprise information security risk management program, including risk assessments across business units, applications, infrastructure, and processes; the risk register; and risk treatment planning. * Drive remediation of identified risks, partnering with control owners and holding the program accountable for closure. * Own the third-party risk management program, including pre-contract security due diligence, recurring vendor risk reviews, the vendor risk inventory, and remediation tracking. Audit and Controls * Oversee responses to client, regulator, and internal audit requests, including security questionnaires (SIG, CAIQ), evidence collection, and findings remediation. * Direct periodic audits of internal control systems to ensure access levels, segregation of duties, and configuration baselines remain appropriate, and lead the response to audit findings requiring action. * Oversee periodic user access and privileged access reviews across in-scope systems and applications, ensuring timely remediation of inappropriate or excessive access. * Partner with Legal, Privacy, and other stakeholders on Electronically Stored Information (ESI) requests, including identification, preservation, collection, and chain-of-custody documentation in support of legal holds, investigations, and regulatory inquiries. Awareness and Platform * Own the enterprise security awareness program, including training curricula and ongoing awareness communications that promote secure behavior across the organization. * Oversee the phishing simulation program, including campaign strategy, results analysis, and remediation training. * Direct administration and enhancement of the enterprise GRC platform, including workflow configuration, control library maintenance, reporting, and user support., Many factors go into determining employee pay within the posted range including business requirements, prior experience, current skills and geographical location. * Corporate Positions: In addition to the base salary, this role may be eligible to participate in a quarterly or annual bonus program based on individual and company performance. * Onsite Property Positions: In addition to the base salary, this role may be eligible to participate in weekly, monthly, and/or quarterly bonus programs. ## Related Videos - [The Cloud is Calling: Answer with In-Demand Skills](https://www.wearedevelopers.com/videos/945-the-cloud-is-calling-answer-with-in-demand-skills) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Forecasting Cyber Attacks with Glassdoor Reviews - Lianne Potter](https://www.wearedevelopers.com/videos/2143-forecasting-cyber-attacks-with-glassdoor-reviews-lianne-potter) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Got AI ideas but no money? Here are 10 free ways to level up your AI skills with Google Cloud](https://www.wearedevelopers.com/magazine/600-got-ai-ideas-but-no-money-here-are-10-free-ways-to-level-up-your-ai-skills-with-google-cloud) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [The Best X (Twitter) Accounts for Developers](https://www.wearedevelopers.com/magazine/294-the-best-x-twitter-accounts-for-developers) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)