Manager, Technology Security and Governance

Who We Are

Core Spaces (Core) is more than a real estate company; it’s a people company. Where building relationships is just as important as building properties. From researchers and architects to designers and operators, Core is made up of risk takers and dreamers who are on a mission to invent the future of living. Our six cultural values guide us every day and we strive to live them in everything we do: PUSH (Invent Better Places to Live), GRIT (We Got This), LIFT (Help Each Other Win), SHINE (Bring Your Full Self), UPHOLD (Never Break Trust), GROW (Always Get Better).

Everything Core does stem from this culture of collaboration and innovation, and the drive to constantly improve the resident experience. This unique approach has led to creating spaces and services that are redefining the way people live.

What We Do

Founded in 2010, Core is a vertically integrated real estate investment manager focused on acquiring, developing and managing across the student housing and build-to-rent (“BTR”) sectors. Its residential communities feature world-class amenities, progressive design, and hospitality-driven service. Core’s student housing portfolio includes over 74,440 beds currently owned or managed, with a pipeline of over 53,860 beds in various stages of development. Core’s BTR division has over 3,000 homes under development, now leasing or in its pipeline in high-growth metros nationwide. For more information, visit www.corespaces.com.

*Portfolio and pipeline numbers as of Q2 2026

Benefits That Matter

• A culture that provides you with a sense of belonging
• Competitive pay that values your contributions
• Incentives designed to reward your achievements
• Paid flexible PTO to disconnect or celebrate life milestones
• Paid 14+ holidays, including your birthday, to disconnect and celebrate
• Paid Parental Leave that begins after 90 days
• Paid volunteer time off to give back to your community
• Monthly workshop weeks; fewer meetings & more collaboration
• Robust health plan options that begin within at least 30 days of your employment
• Monthly phone reimbursement
• Wellness allowance and perks, including a yearly subscription to a meditation app
• An environment that provides you a voice to share your perspectives
• Employee Assistance Program (EAP) for access to confidential support services
• Company retirement options including 401(k) + matching & Roth account option

Position Overview

The Manager, Technology, Security & Governance will own and mature Core’s technology security, compliance, and governance capabilities. This hands-on leader will translate security and regulatory requirements into practical, auditable controls; administer and oversee critical security processes across the Microsoft environment and key business systems; and drive remediation, assess governance, third-party risk, and incident readiness.

Working closely with Technology, Finance, Human Resources, Legal, business leaders, auditors, consultants, and managed service partners, this role will strengthen internal ownership, reduce reliance on external partners, and advance initiatives in a way that protects Core while enabling the business to move efficiently.

What You Will Do

Own and mature Core’s technology security and governance program, establishing scalable policies, standards, control procedures, decision rights, and operating rhythms that align security priorities with business objectives and create sustainable internal accountability.

Lead IT compliance and audit readiness by interpreting applicable requirements, designing and documenting auditable controls, coordinating evidence collection and testing, evaluating exceptions, and driving timely remediation of findings with accountable owners across Technology, Finance, and the business.

Direct enterprise identity and access governance, including recurring user access reviews, privileged and administrator access reviews, segregation-of-duties considerations, joiner-mover-leaver controls, and remediation across Microsoft, Paycom, Yardi, and other critical platforms.

Provide hands-on oversight of the Microsoft environment, including Microsoft 365 and SharePoint administration, security and compliance configurations, policy review, reporting, administrator activity and change-log analysis, and coordination of complex engineering changes with internal resources and managed service partners.

Own the third-party risk management lifecycle for a growing vendor portfolio, including intake, tiering, due diligence, security assessments, risk scoring, contract-control input, issue tracking, periodic reassessment, exception management, and executive reporting; administer and enhance supporting workflows and tools such as ProcessUnity.

Lead security investigations and control remediation, assessing issues and alerts, determining business impact and required action, coordinating technical response, documenting root causes, and ensuring corrective actions are implemented and sustained.

Advance Core’s security framework and risk-management practices using NIST and other relevant standards, identifying control gaps, prioritizing risk-based improvements, and maintaining roadmaps that balance risk reduction, operational complexity, cost, and business priorities.

Strengthen incident response readiness by maintaining plans and escalation paths, coordinating tabletop exercises, supporting response activities, documenting lessons learned, and tracking improvements through completion.

Develop meaningful security, compliance, and governance reporting, including metrics, dashboards, risk narratives, and executive-ready updates that clarify exposure, control effectiveness, audit status, remediation progress, and decisions requiring leadership attention.

Serve as a trusted, business-facing security advisor, translating technical and regulatory requirements into clear recommendations, reading stakeholder needs, building support for change, and implementing controls with appropriate rigor and minimal unnecessary friction.

Manage external security relationships and delivery, setting expectations for consultants, contractors, fractional leaders, auditors, and managed service providers; reviewing work quality; resolving dependencies; and transitioning appropriate knowledge and responsibilities in-house.

Monitor emerging threats, technology changes, and regulatory expectations, assess their relevance to Core, and recommend proportionate updates to controls, processes, training, and investment priorities.

Occasional travel may be necessary as needed.

Perform other duties and tasks as assigned by management.

Must be able to complete all physical requirements of this role with or without a reasonable accommodation.

Ideally, You'll Have

Bachelor’s degree in cybersecurity, information technology, information systems, risk management, or a related field, or an equivalent combination of education and relevant experience.

Seven or more years of progressive experience in information security, IT governance, technology risk, compliance, or related disciplines, including meaningful ownership of programs, controls, or remediation activities.

Demonstrated success building, maturing, or independently owning security, compliance, or governance capabilities in a growing or changing organization—not solely monitoring or reporting within an established program.

Hands-on experience with Microsoft 365 security and administration, including the ability to navigate a Microsoft tenant, evaluate policies and configurations, produce reports, investigate activity, and partner effectively on technical changes; working knowledge of SharePoint governance is required.

Deep experience with identity and access governance, including user access reviews, privileged access, administrator activity, access remediation, and control documentation across enterprise applications.

Experience designing, operating, testing, and remediating IT controls in a SOX-regulated, audit-intensive, or comparably controlled environment, with the ability to produce clear, complete, and repeatable evidence.

Experience owning third-party technology and security risk processes, including due diligence, risk assessment, issue management, ongoing monitoring, and communication with business and vendor stakeholders.

Sound judgment and analytical ability to evaluate ambiguous security and compliance issues, weigh risk and business impact, determine an appropriate course of action, and escalate material matters effectively.

Strong executive presence, written and verbal communication, facilitation, and change-management skills, with a record of translating complex requirements, reading the room, building consensus, and influencing leaders without relying on direct authority.

Ability to manage multiple high-priority workstreams independently, establish structure in an evolving environment, meet recurring deadlines, and maintain attention to detail.

Experience directing the work of consultants, contractors, auditors, or managed service providers and holding partners accountable for quality, timeliness, and knowledge transfer.

You'll crush it if you have experience with

Administering ProcessUnity or a comparable governance, risk, compliance, or third-party risk platform.

Applying NIST CSF, ITIL, or similar frameworks to create practical security, risk, service-management, and governance processes.

Leading incident response planning, tabletop exercises, investigations, and after-action remediation.

Developing executive dashboards and risk reporting for audit findings, access governance, third-party risk, control health, and remediation progress.

Working in a high-growth, mid-sized, or entrepreneurial environment where you personally built capabilities and moved between strategic leadership and hands-on execution.

Leading people or serving in a security leadership, fractional CISO, security program management, or CISO-adjacent capacity while remaining close to day-to-day operations.

Relevant credentials such as CISM, CISSP, CISA, Security+, Microsoft security certifications, or ITIL certification.

Organizational Structure

Reports to: Vice President, Technology

Direct Reports: N/A

Disclaimer

Please note that job responsibilities, reporting lines, and duties outlined in this job description are subject to change to meet the evolving needs of the organization.

As an Equal Opportunity Employer, Core Spaces celebrates diversity and is committed to creating an equitable and inclusive environment, which creates a sense of belonging for all employees. We do not discriminate and believe every individual should be proud of who they are and the community they represent.

Pay Range

USD $150,000.00 - USD $156,000.00 /Yr.

Compensation Disclosure

The compensation range listed reflects the base salary or hourly rate that we reasonably and in good faith expect to offer for this role at the time of posting. Actual compensation may vary based on factors such as education, experience, skills, certifications, seniority, geographic location, and business needs.