Director, Integrated Security

Cornerstone Home Lending•Plano, TX

5d•$130,000 - $165,000

About The Position

The Director, Integrated Security serves as the Bank’s second line of defense (2LOD) leader for security risk, providing independent oversight, credible challenge, and assurance over the first line’s management of information security, IT, privacy, and corporate security risks. The role does not own or operate security controls. It establishes the enterprise security risk framework, defines risk appetite and policy standards, evaluates the design and operating effectiveness of first-line programs, and independently reports the Bank’s security risk posture to executive management, the Risk Committee, and the Board. The Director maintains functional independence from first-line operational security teams. The areas of oversight include Enterprise Security Governance and the Bank’s policies, frameworks, and risk standards for Information Security, IT Risk Management, Privacy, and Corporate Security. The role also oversees the Bank Protection Officer function and compliance with the Bank Protection Act and 12 CFR Part 21. The position has business continuity ownership, including developing and maintaining continuity and resiliency plans, coordinating testing and recovery, leading crisis response and recovery coordination during disruptions, and reporting continuity risks and program performance. It delivers an independent Annual Security Risk Report to the Board, including an assessment of the adequacy of the first line’s security program and outstanding risk issues.

Requirements

At least 10 years of experience in information security, technology risk, or operational risk management within the financial services sector, including at least 5 years in a second-line-of-defense, risk oversight, or audit capacity.
At least 5 years of mid- to large-bank experience, including direct interaction with regulators such as OCC, FRB, FDIC, NYDFS, or state banking departments, and with the Board or its Risk Committee.
Expert knowledge of three-lines-of-defense risk governance, enterprise risk management frameworks, regulatory expectations including the FFIEC IT Handbook, NIST CSF, NYDFS Part 500, GLBA, and SR Letters, and the principles of independent and effective challenge.
Strong analytical reasoning, problem-solving, and critical-thinking skills.
Strong computer and organizational skills.
Strong oral and written presentation skills.
Ability to work independently with a multi-level team.
Ability to multitask and meet deadlines.
Strong proficiency with Microsoft Office, including Word, Excel, and Outlook.

Nice To Haves

Bachelor’s degree preferred.
Current Certified Information Systems Security Professional (CISSP) certification.
Current Certified in Risk and Information Systems Control (CRISC) certification.
Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), or equivalent risk/audit certification preferred.

Responsibilities

Establish and maintain the enterprise security risk management framework, including risk appetite statements, policies, minimum control standards, and risk taxonomies for first-line implementation.
Review and challenge first-line policies, standards, and procedures for alignment with regulatory expectations, the Bank’s risk appetite, and industry frameworks such as NIST CSF, FFIEC CAT, and ISO 27001.
Independently assess the first line’s identification, measurement, and management of security risks, including RCSAs, issue management, and key risk indicators.
Challenge first-line risk treatment decisions, exception requests, and risk acceptances; escalate unresolved concerns through governance committees to executive management and the Board.
Monitor and independently assess first-line compliance with applicable laws, regulations, and supervisory expectations, and track remediation of regulatory findings and matters requiring attention.
Partner with the Chief Privacy Officer to oversee and challenge first-line implementation of GLBA privacy provisions and other consumer data protection requirements.
Establish minimum standards for first-line incident response, business resilience, and cyber recovery programs; review and challenge program design, testing, and continuous improvement.
Provide advisory oversight during material security incidents; conduct independent post-incident reviews of response effectiveness and root-cause remediation, and report findings to executive management and the Board.
Set enterprise expectations for first-line security awareness and role-based training; assess effectiveness through metrics, phishing test results, and behavioral indicators.
Monitor and report on enterprise security risk culture, identify gaps, and recommend improvements to executive management and the Board.
Set control objectives and minimum technical standards for security architecture and tooling; review and challenge first-line technology selection, design, and deployment decisions.
Independently test and validate the design and operating effectiveness of key first-line security controls, document findings, and track remediation through closure.
Coordinate with first-line technology and business owners, Enterprise Risk Management, Compliance, Legal, and Internal Audit to clarify roles, avoid duplication, and preserve the independence of the second-line challenge function.
Engage business and technology leaders on strategic initiatives, provide advisory input on emerging security risks, and assess whether first-line risk management is commensurate with risks taken.
Produce independent reporting on security risk posture, control effectiveness, key risk indicators, and emerging threats for executive management, the Risk Committee, and the Board, with an unfiltered reporting line that does not require first-line approval.
Review first-line security metrics, KRIs, and breach and event trends to form an independent view of risk relative to appetite.
Develop and maintain business continuity and resiliency plans; conduct business impact analyses and continuity risk assessments.
Coordinate continuity testing, exercises, and corrective actions; maintain continuity governance, reporting, and documentation.
Lead crisis response and recovery coordination during disruptions and partner with business units and vendors to strengthen operational resilience.
Monitor compliance with continuity policies and regulatory expectations; deliver continuity training and awareness programs.
Report continuity risks and program performance to management and align business continuity, disaster recovery, and incident management activities.
Provide oversight of the Bank Protection Officer function and the Bank’s compliance with the Bank Protection Act and 12 CFR Part 21.
Deliver an independent Annual Security Risk Report to the Board, assessing the adequacy of the first line’s security program and outstanding risk issues.
Advise on security awareness and training curriculum.
Provide a second-line governance perspective on enterprise security and resilience initiatives so risk considerations are incorporated from inception.
Perform other duties as assigned.