IT and Security for a 27-Location Public REIT

The problem

Starwood Waypoint Residential Trust (NYSE: SWAY) was a publicly traded REIT with $2B+ in assets and 600+ employees across 27 locations. I was Head of Infrastructure & Security from 2014 to 2016, with an eight-figure operating and capital budget and a nationwide fleet of 10,000+ devices: end-user systems, servers, networks, telecom, and branch IT buildouts. In that role I led the IT and security workstreams through the IPO and the subsequent acquisition.

The approach

With 27 locations, the first thing I'd standardize is the branch: the same network, telecom, and end-user build at every site, so any site can be supported like any other.

I built a four-team security org: Red, Blue, Security Engineering, and Trust & Compliance. Splitting it that way gives each team one job, and the people testing controls aren't the people who built them.

I put security measurement on KPIs tied to board reporting. A board can't act on a status update. It can act on a trend, the argument I make in Board Reporting That Drives Decisions. I also drove IT governance and vendor consolidation. At this scale an overlapping contract is cost without added coverage; 70 Security Tools, 9 Controls makes the same point about security tooling.

The outcome

IT governance and vendor consolidation saved $1.2M one-time and $300K recurring per year, and security reporting reached the board as KPIs. For any multi-site company, my starting list doesn't change: one standard branch build, a security org with clear lanes, and a few KPIs the board sees every time.