Manager- IT Governance, Risk, and Compliance

Manager – IT Governance, Risk, and Compliance

UDR is seeking a Manager – IT Governance, Risk, and Compliance (GRC) to lead and strengthen our enterprise technology governance, risk management, and compliance programs. This role is responsible for advancing audit readiness, consumer privacy, third-party risk management, IT policy management, and AI and data governance initiatives across the organization.

The Manager will partner closely with Information Technology, Cybersecurity, Internal Audit, Legal, external auditors, and business stakeholders to manage compliance requirements, identify and mitigate risk, and ensure our technology practices align with regulatory obligations and business objectives. This position will also lead and develop GRC and Privacy team members while providing meaningful reporting and risk insights to IT leadership and the Board of Directors.

What You Will Do

IT Governance, Risk, and Compliance

• Lead UDR’s IT SOX audit program and serve as the primary management escalation point for external auditors, coordinating quarterly, annual, and ad hoc audit requests.

• Direct the annual NIST Cybersecurity Framework (CSF) self-assessment, including scoping, coordinating control owners, identifying gaps, and reporting results to IT leadership.

• Develop and implement new compliance audits and assessments, including CCPA/CPRA cybersecurity audit and risk assessment requirements.

• Maintain and enhance UDR’s IT policy library to address compliance gaps, support ISO 27001 alignment, and meet evolving business and security needs.

• Oversee IT policy development, approvals, annual reviews, and exception requests, providing recommendations to IT leadership on policy exceptions.

• Manage UDR’s policy management platform and evaluate GRC tools to support current and emerging compliance requirements.

• Maintain the GRC compliance calendar and deliver audit status updates, compliance metrics, and risk reporting for executive leadership and the Board of Directors.

AI Governance, Privacy, and Data Governance

• Support UDR’s AI governance program by maintaining the AI Acceptable Use Policy, enhancing AI intake requirements, developing risk classification practices, and facilitating AI Governance Committee meetings.

• Participate in the AI Council and escalate material AI risks, including fair housing and SEC disclosure considerations, to the appropriate IT and Legal leaders.

• Oversee data subject access requests (DSARs) and consumer privacy requests across the states where UDR operates, including requests submitted through the “Your Privacy Choices” form.

• Guide the investigation and resolution of complex privacy requests, consumer complaints, and incidents, maintaining appropriate evidence handling and chain-of-custody practices.

• Monitor emerging state privacy legislation in partnership with Legal and Government Affairs and assess impacts to UDR’s privacy program.

• Partner with Marketing and Legal on privacy policy updates, annual reviews, website privacy controls, cookie banners, and consent management.

• Collaborate with IT on data governance practices, including role-based access control, data classification and tagging, data masking, and row- and column-level security.

• Oversee enterprise training and awareness initiatives related to data privacy, AI governance, and GRC compliance.

Third-Party Risk Management

• Lead UDR’s vendor risk assessment (VRA) program, including intake, annual reassessments, program metrics, and review of assessments for new vendors and recertifications.

• Approve routine vendor risk assessment outcomes within established thresholds and recommend non-routine risk decisions to IT leadership.

• Communicate vendor risk findings to stakeholders and coordinate vendor discussions to resolve identified concerns.

• Partner with Legal on vendor contracting requirements, including Data Security Addenda, mutual nondisclosure agreements, and AI-specific contractual protections.

• Help establish appropriate contractual safeguards for AI-enabled vendor solutions, including audit rights, bias testing obligations, and incident notification requirements.

Team Leadership and Development

• Lead, mentor, and develop GRC and Privacy team members, supporting professional growth and career progression.

• Establish priorities, assign work, and review deliverables to ensure quality, consistency, and timely completion of team objectives.

• Manage team performance, including goal setting, performance reviews, coaching, corrective action, and other personnel decisions as appropriate.

• Foster a collaborative and accountable team environment while addressing employee concerns and supporting effective working relationships.

What You Will Bring

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or a related field preferred; an equivalent combination of education and experience will be considered.

• Minimum of eight years of experience working in IT governance, risk, and compliance.

• Minimum of five years of experience managing technology-focused programs and projects.

• Minimum of three years of experience managing a team within IT GRC, privacy, or IT security.

• Demonstrated experience supporting IT SOX controls, external audits, NIST CSF assessments, ISO 27001, or comparable compliance frameworks.

• Strong knowledge of U.S. state privacy laws, including CCPA/CPRA, and established vendor risk management practices.

• Experience managing cross-functional compliance initiatives, coordinating multiple stakeholders, and translating complex requirements into actionable plans.

• Excellent written and verbal communication skills, including the ability to present risk assessments, audit findings, and recommendations to senior leadership.

• Strong organizational, analytical, and problem-solving skills, with the ability to manage competing priorities and exercise sound judgment.

• Ability to build effective partnerships across IT, Legal, Cybersecurity, Internal Audit, vendors, and business teams.

• Proficiency with Microsoft Office and standard reporting, collaboration, and project management tools.

Preferred Qualifications

• Certifications such as CISA, CRISC, CISSP, CIPP/US, or comparable audit, risk, privacy, or security credentials.

• Experience developing and maintaining IT policies, compliance calendars, risk reporting, and executive-level dashboards.

• Experience supporting AI governance programs, data privacy initiatives, and emerging technology risk assessments.

Work Environment

This position operates in a standard office environment with a flexible hybrid work schedule, subject to management approval. Occasional evening or weekend work may be required to support business needs.

Why Join UDR?

At UDR, you'll have the opportunity to make a meaningful impact by strengthening the security, governance, and compliance practices that support our business. You'll collaborate with leaders across technology and the enterprise, help shape emerging AI and privacy initiatives, and build programs that evolve alongside our business.

Benefits Offered

• Medical, Dental, Vision Plans
• Medical Flexible Spending Account
• Dependent Care Spending Account
• Lifestyle Spending Account
• Supplemental Term Life Insurance
• Voluntary Cancer Insurance
• Supplemental Short-Term Disability Insurance / AD&D Insurance
• Voluntary Long Term Care Insurance
• 401(k) Plan with company match

Salary Range

• $130,611.00/yr. – $150,000.00/yr., depends on experience

Bonus Potential

• Eligible for 15% annual bonus potential, based on personal and company performance

UDR is proud to provide equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training. UDR is committed to providing and maintaining a diverse workforce and an inclusive work environment with equitable access and opportunity for associates to participate, grow, and reach their full potential