Cybersecurity Director – Data Protection, Security Architecture & Third-Party Risk

Cybersecurity Jobs; Richardson (TX); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Health insurance coverage

Wellness program

Fertility and family building aids

Life and disability insurance

Retirement savings plans with a 401K 3

Paid leave programs

Paid holidays

PTO

Job summary

Texas Capital Bank is seeking an Information Security Director to lead data protection and security architecture across on‑prem, cloud and endpoints. You will govern data handling rules, DLP, and vendor risk management while partnering with risk, legal, and IT teams to protect sensitive information.

You will drive a sustainable data protection model, develop measurable outcomes, and ensure effective incident response collaboration with internal and third-party teams in a fast-paced banking

Qualifications

• 10+ years in information security leadership.
• Experience leading data protection, DLP, and labeling initiatives.
• Proven ability to create governance-driven security programs.
• Experience managing the vendor risk lifecycle end to end.
• Strong stakeholder management across legal, privacy, IT, procurement.
• Cloud security architecture experience in major environments.

Responsibilities

• Own the enterprise data protection strategy and operating model.
• Lead security architecture governance with reference architectures.
• Oversee end-to-end third-party security risk management.
• Coordinate incident response across internal and vendor teams.
• Partner with data owners to align controls with data flows.

Skills

Data protection

Security architecture

Vendor risk management

Incident response

Governance

Stakeholder management

Education

Bachelor’s degree in Information Security, Information Technology, Computer Science, Engineering

Tools

DLP

IAM

Job description

The Information Security Director for Data Protection, Security Architecture, and Third-Party Cyber Risk Management at Texas Capital Bank is responsible for building the operating model and measurable outcomes that protect sensitive information across on-prem, cloud, and endpoint environments. This role governs security architecture standards, manages vendor security risk end to end, and partners closely with incident response to ensure preparedness and effective execution.

Data Protection Strategy and Operating Model

• Own the enterprise data protection strategy and operating model, including classification and labeling, data handling rules, DLP, and measurable enforcement outcomes.
• Define and maintain a sustainable classification approach, such as a small, understandable taxonomy linked to handling expectations and controls, with active governance and ownership over time.
• Implement a phased DLP enforcement approach, including visibility, controlled user education, and targeted enforcement to reduce false positives and operational friction.
• Establish exception processes, review cadence, and tuning workflows to keep data protection program elements current and operationally effective.
• Partner with IT, risk, privacy, legal, compliance, and business data owners to align protection controls to real data flows and regulatory expectations.

Security Architecture Governance

• Lead a team of security architects responsible for the security architecture blueprint, including reference architectures, control standards, and reusable patterns.
• Run architecture reviews for new technologies and major changes to ensure security requirements are measurable, implementable, and governed through formal exception handling.
• Ensure security architecture integrates with enterprise platforms such as IAM, logging and monitoring, endpoint security, and cloud controls, while supporting delivery velocity using clear guardrails.

Third-Party Cyber Risk Management

• Own the end-to-end vendor security assessment lifecycle, including intake, risk tiering, due diligence, remediation tracking, risk acceptance, and renewal or continuous monitoring.
• Establish and maintain a standardized third-party security addendum and baseline contractual security requirements, with deviations handled through a formal, risk-based exception process.
• Ensure vendor security requirements are specific and enforceable, including defined incident reporting timelines, audit rights, and consequences for non-compliance.
• Ensure contractual obligations support response needs, including notification windows and expectations for vendor root-cause analysis and corrective actions.

Incident Response Collaboration Across Internal and Third Parties

• Ensure incident response capabilities are defined, tested, and integrated across internal teams and third parties, including escalation, containment, recovery, and post-incident corrective actions.
• Coordinate preparedness and operational expectations so response reporting obligations and execution align across internal and vendor events.

Required Qualifications

• Bachelor’s degree in Information Security, Information Technology, Computer Science, Engineering, or a related field.
• 10+ years in information security, including leadership over at least two of: data protection/DLP, security architecture, third-party risk, and incident response.
• Experience building governance-driven security programs that balance control enforcement with operational adoption.
• Demonstrated ability to create measurable, enforceable vendor security requirements and manage exceptions through risk-based governance.
• Experience operationalizing the vendor risk lifecycle, including tiering, due diligence, remediation, acceptance, and continuous monitoring.
• Strong stakeholder management across legal, privacy, compliance, IT, procurement, and business leadership.
• Experience operationalizing a sustainable data protection model, including classification and labeling plus DLP tuning and rollout.
• Experience managing third-party cybersecurity risk, including due diligence, contract language, ongoing monitoring, and incident response.
• Cloud security architecture experience in major cloud provider environments and integration of endpoint data controls.

Technologies

• DLP
• IAM

Benefits

• Health insurance coverage
• Wellness program
• Fertility and family building aids
• Life and disability insurance
• Retirement savings plans with a generous 401K match
• Paid leave programs
• Paid holidays
• Paid time off (PTO)

Reporting Line and Scope

• Reports to: CISO
• Data Protection: classification, DLP, encryption, data handling rules, and monitoring or response workflows across endpoint, cloud, and on-premises environments.
• Security Architecture: enterprise security architecture blueprint, patterns and standards, and architecture reviews for new technologies.
• Third-Party Cyber Risk: vendor security due diligence, ongoing monitoring, security addendum and contract requirements, and exception governance.
• 3rd Party Cyber Incident Response: operational oversight and enablement, including defining requirements, playbooks, testing, and coordination across teams and vendors.

Role Location and Experience Level

• Location: Richardson, TX (onsite)
• Minimum experience: 10 years