Position OverviewThe Manager, Technology, Security & Governance will own and mature Core's technology security, compliance, and governance capabilities. This hands-on leader will translate security and regulatory requirements into practical, auditable controls; administer and oversee critical security processes across the Microsoft environment and key business systems; and drive remediation, assess governance, third-party risk, and incident readiness. Working closely with Technology, Finance, Human Resources, Legal, business leaders, auditors, consultants, and managed service partners, this role will strengthen internal ownership, reduce reliance on external partners, and advance initiatives in a way that protects Core while enabling the business to move efficiently.
What You Will Do- Own and mature Core's technology security and governance program, establishing scalable policies, standards, control procedures, decision rights, and operating rhythms that align security priorities with business objectives and create sustainable internal accountability.
- Lead IT compliance and audit readiness by interpreting applicable requirements, designing and documenting auditable controls, coordinating evidence collection and testing, evaluating exceptions, and driving timely remediation of findings with accountable owners across Technology, Finance, and the business.
- Direct enterprise identity and access governance, including recurring user access reviews, privileged and administrator access reviews, segregation-of-duties considerations, joiner-mover-leaver controls, and remediation across Microsoft, Paycom, Yardi, and other critical platforms.
- Provide hands-on oversight of the Microsoft environment, including Microsoft 365 and SharePoint administration, security and compliance configurations, policy review, reporting, administrator activity and change-log analysis, and coordination of complex engineering changes with internal resources and managed service partners.
- Own the third-party risk management lifecycle for a growing vendor portfolio, including intake, tiering, due diligence, security assessments, risk scoring, contract-control input, issue tracking, periodic reassessment, exception management, and executive reporting; administer and enhance supporting workflows and tools such as ProcessUnity.
- Lead security investigations and control remediation, assessing issues and alerts, determining business impact and required action, coordinating technical response, documenting root causes, and ensuring corrective actions are implemented and sustained.
- Advance Core's security framework and risk-management practices using NIST and other relevant standards, identifying control gaps, prioritizing risk-based improvements, and maintaining roadmaps that balance risk reduction, operational complexity, cost, and business priorities.
- Strengthen incident response readiness by maintaining plans and escalation paths, coordinating tabletop exercises, supporting response activities, documenting lessons learned, and tracking improvements through completion.
- Develop meaningful security, compliance, and governance reporting, including metrics, dashboards, risk narratives, and executive-ready updates that clarify exposure, control effectiveness, audit status, remediation progress, and decisions requiring leadership attention.
- Serve as a trusted, business-facing security advisor, translating technical and regulatory requirements into clear recommendations, reading stakeholder needs, building support for change, and implementing controls with appropriate rigor and minimal unnecessary friction.
- Manage external security relationships and delivery, setting expectations for consultants, contractors, fractional leaders, auditors, and managed service providers; reviewing work quality; resolving dependencies; and transitioning appropriate knowledge and responsibilities in-house.
- Monitor emerging threats, technology changes, and regulatory expectations, assess their relevance to Core, and recommend proportionate updates to controls, processes, training, and investment priorities.
- Occasional travel may be necessary as needed.
- Perform other duties and tasks as assigned by management.
- Must be able to complete all physical requirements of this role with or without a reasonable accommodation.
Ideally, You'll Have- Bachelor's degree in cybersecurity, information technology, information systems, risk management, or a related field, or an equivalent combination of education and relevant experience.
- Seven or more years of progressive experience in information security, IT governance, technology risk, compliance, or related disciplines, including meaningful ownership of programs, controls, or remediation activities.
- Demonstrated success building, maturing, or independently owning security, compliance, or governance capabilities in a growing or changing organization-not solely monitoring or reporting within an established program.
- Hands-on experience with Microsoft 365 security and administration, including the ability to navigate a Microsoft tenant, evaluate policies and configurations, produce reports, investigate activity, and partner effectively on technical changes; working knowledge of SharePoint governance is required.
- Deep experience with identity and access governance, including user access reviews, privileged access, administrator activity, access remediation, and control documentation across enterprise applications.
- Experience designing, operating, testing, and remediating IT controls in a SOX-regulated, audit-intensive, or comparably controlled environment, with the ability to produce clear, complete, and repeatable evidence.
- Experience owning third-party technology and security risk processes, including due diligence, risk assessment, issue management, ongoing monitoring, and communication with business and vendor stakeholders.
- Sound judgment and analytical ability to evaluate ambiguous security and compliance issues, weigh risk and business impact, determine an appropriate course of action, and escalate material matters effectively.
- Strong executive presence, written and verbal communication, facilitation, and change-management skills, with a record of translating complex requirements, reading the room, building consensus, and influencing leaders without relying on direct authority.
- Ability to manage multiple high-priority workstreams independently, establish structure in an evolving environment, meet recurring deadlines, and maintain attention to detail.
- Experience directing the work of consultants, contractors, auditors, or managed service providers and holding partners accountable for quality, timeliness, and knowledge transfer.
You'll crush it if you have experience with- Administering ProcessUnity or a comparable governance, risk, compliance, or third-party risk platform.
- Applying NIST CSF, ITIL, or similar frameworks to create practical security, risk, service-management, and governance processes.
- Leading incident response planning, tabletop exercises, investigations, and after-action remediation.
- Developing executive dashboards and risk reporting for audit findings, access governance, third-party risk, control health, and remediation progress.
- Working in a high-growth, mid-sized, or entrepreneurial environment where you personally built capabilities and moved between strategic leadership and hands-on execution.
- Leading people or serving in a security leadership, fractional CISO, security program management, or CISO-adjacent capacity while remaining close to day-to-day operations.
- Relevant credentials such as CISM, CISSP, CISA, Security+, Microsoft security certifications, or ITIL certification.
Organizational StructureReports to: Vice President, Technology
Direct Reports: N/A
DisclaimerPlease note that job responsibilities, reporting lines, and duties outlined in this job description are subject to change to meet the evolving needs of the organization.
Pay RangeUSD $150,000.00 - USD $156,000.00 /Yr.
Compensation DisclosureThe compensation range listed reflects the base salary or hourly rate that we reasonably and in good faith expect to offer for this role at the time of posting. Actual compensation may vary based on factors such as education, experience, skills, certifications, seniority, geographic location, and business needs.
This role may be eligible for additional forms of compensation, including bonuses, commissions, stipends, or non-cash incentives, depending on position and performance. Benefits may include health insurance, retirement plans, paid time off, and other role-based offerings, subject to eligibility requirements.
All compensation components are subject to change based on business needs or market conditions.
