Director, Integrated Security

Cornerstone Capital Bank•Houston, TX

About The Position

The Director, Integrated Security serves as the Bank’s second line of defense (2LOD) leader for security risk. The role provides independent oversight, credible challenge, and assurance over the first line’s management of information security, IT, privacy, and corporate security risks. It does not own or operate security controls; instead, it establishes the enterprise security risk framework, defines risk appetite and policy standards, evaluates first-line program design and operating effectiveness, and reports an independent view of the Bank’s security risk posture to executive management, the Risk Committee, and the Board. Oversight covers enterprise security governance and the Bank’s policies, frameworks, and risk standards for information security, IT risk management, privacy, and corporate security. The Director maintains functional independence from first-line operational security teams. The position also owns business continuity and resiliency planning, including business impact analyses, risk assessments, exercises, corrective actions, governance, crisis response coordination, training, and reporting. It provides oversight of the Bank Protection Officer function and the Bank’s compliance with the Bank Protection Act and 12 CFR Part 21. The Director delivers an independent Annual Security Risk Report to the Board and provides second-line governance input on enterprise security and resilience initiatives. Cornerstone Capital Bancorp, Inc. is a Texas-based financial services company headquartered in Houston. Through Cornerstone Capital Bank, it operates a community and business banking franchise and a national home lending, servicing, and home insurance platform. The company operates 17 full-service banking locations across Texas and more than 150 mortgage offices nationwide, serves nearly 700,000 customers through its family of brands, and is supported by 1,600 team members.

Requirements

At least 10 years of experience in information security, technology risk, or operational risk management within the financial services sector.
At least 5 years in a second-line-of-defense, risk oversight, or audit capacity.
At least 5 years of mid- to large-bank experience, including direct interaction with regulators such as OCC, FRB, FDIC, NYDFS, or state banking departments and with the Board or its Risk Committee.
Expert knowledge of three-lines-of-defense risk governance, enterprise risk management frameworks, regulatory expectations including the FFIEC IT Handbook, NIST CSF, NYDFS Part 500, GLBA, and SR Letters, and principles of independent and effective challenge.
Strong analytical reasoning, problem-solving, and critical-thinking skills.
Strong computer and organizational skills.
Strong oral and written presentation skills.
Ability to work independently with a multi-level team.
Ability to multitask and meet deadlines.
Strong proficiency with Microsoft Office, including Word, Excel, and Outlook.
Success in the role relies on time management, organization, and a positive attitude.

Nice To Haves

Bachelor’s degree preferred.
Current Certified Information Systems Security Professional (CISSP) certification.
Current Certified in Risk and Information Systems Control (CRISC) certification.
Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), or equivalent risk or audit certification preferred.

Responsibilities

Establish and maintain the enterprise security risk management framework, including risk appetite statements, policies, minimum control standards, and risk taxonomies for first-line implementation.
Review and challenge first-line policies, standards, and procedures for alignment with regulatory expectations, the Bank’s risk appetite, and frameworks such as NIST CSF, FFIEC CAT, and ISO 27001.
Independently assess first-line identification, measurement, and management of security risks, including risk and control self-assessments, issue management, and key risk indicators.
Challenge first-line risk treatment decisions, exception requests, and risk acceptances; escalate unresolved concerns through governance committees to executive management and the Board.
Monitor and independently assess first-line compliance with applicable laws, regulations, and supervisory expectations, and track remediation of regulatory findings and matters requiring attention.
Partner with the Chief Privacy Officer to oversee and challenge first-line implementation of GLBA privacy provisions and other consumer data protection requirements.
Establish minimum standards for first-line incident response, business resilience, and cyber recovery programs; review and challenge their design, testing, and improvement.
Provide advisory and oversight support during material security incidents, conduct independent post-incident reviews, and report findings to executive management and the Board.
Set enterprise expectations for security awareness and role-based training; independently assess effectiveness using metrics, phishing results, and behavioral indicators.
Monitor and report on enterprise security risk culture, identifying gaps and recommending improvements to executive management and the Board.
Set security architecture and tooling control objectives and minimum technical standards; review and challenge first-line technology decisions for alignment with risk appetite.
Independently test and validate key first-line security controls, document findings, and track remediation through closure.
Coordinate with first-line technology and business owners, Enterprise Risk Management, Compliance, Legal, and Internal Audit to clarify roles, avoid duplication, and preserve second-line independence.
Engage business and technology leaders on strategic initiatives, provide advisory input on emerging security risks, and assess whether first-line risk management is commensurate with risks taken.
Produce independent security risk reporting for executive management, the Risk Committee, and the Board without requiring first-line approval.
Review first-line security metrics, KRIs, and breach and event trends to form an independent view of risk relative to appetite.
Develop and maintain business continuity and resiliency plans; conduct business impact analyses and continuity risk assessments.
Coordinate continuity testing, exercises, and corrective actions; maintain business continuity governance, reporting, and documentation.
Lead crisis response and recovery coordination during disruptions and partner with business units and vendors to strengthen operational resilience.
Monitor compliance with continuity policies and regulatory expectations; deliver continuity training and awareness programs; report program performance and risks to management.
Align business continuity, disaster recovery, and incident management activities.
Provide oversight of the Bank Protection Officer function and the Bank’s compliance with the Bank Protection Act and 12 CFR Part 21.
Deliver an independent Annual Security Risk Report to the Board assessing the adequacy of the first line’s security program and outstanding risk issues.
Advise on security awareness and training curriculum and provide second-line governance perspective on enterprise security and resilience initiatives.
Perform other duties as assigned.