Cybersecurity Director – Data Protection, Security Architecture & Third-Party Risk

Texas Capital Bank; Texas; On-site; USD 180,000 - 260,000; Full time

Benefits offered by this job

Health insurance coverage

Wellness program

Fertility and family building aids

Life and disability insurance

Retirement savings with 401K match

Paid leave and holidays / PTO

Job summary

Texas Capital Bank seeks an experienced Information Security Director to lead enterprise Data Protection, Security Architecture, and Third-Party Cyber Risk Management. You will own the operating model, govern architecture standards, and oversee vendor due diligence with a focus on clear governance and exception handling.

Reporting to the CISO, you will manage a team of security architects, collaborate with IR, and ensure preparedness across internal and third-party events while driving

Qualifications

• Bachelor's degree in Information Security, Information Technology, Computer Science, Engineering or related field.
• 10+ years in information security, including leadership over at least two of: data protection/DLP, security architecture, third-party risk, incident response.
• Experience building governance-driven security programs that balance control enforcement with operational adoption.
• Demonstrated ability to create measurable, enforceable vendor security requirements and manage exceptions via risk-based governance.
• Experience operationalizing vendor risk lifecycle activities (tiering, due diligence, remediation, acceptance, continuous monitoring).
• Strong stakeholder management across legal, privacy, compliance, IT, procurement, and business leadership.
• Experience implementing a sustainable data protection model (labels/classification + DLP tuning and rollout).
• Experience managing 3rd party cybersecurity risk program including due diligence, contract language, ongoing monitoring, and incident response.

Responsibilities

• Data protection program leadership across on-prem, cloud, and endpoint environments.
• Security architecture leadership including reference architectures and reviews for new technologies.
• Third-party risk management & due diligence for vendor security and contract requirements.
• 3rd Party Cyber Incident Response (IR) oversight, preparedness, and cross-team coordination across vendors.

Skills

Leadership

Governance

Vendor risk management

Stakeholder management

Security architecture

Education

Bachelor's degree in Information Security, Information Technology, Computer Science, Engineering or related field

Job description

Texas Capital is built to help businesses and their leaders. Our depth of knowledge and expertise allows us to bring the best of the big firms at a scale that works for our clients, with highly experienced bankers who truly invest in people’s success — today and tomorrow. While we are rooted in core financial products, we are differentiated by our approach. Our bankers are seasoned financial experts who possess deep experience across a multitude of industries. Equally important, they bring commitment — investing the time and resources to understand our clients’ immediate needs, identify market opportunities and meet long-term objectives. At Texas Capital, we do more than build business success. We build long-lasting relationships. Texas Capital provides a variety of benefits to colleagues, including health insurance coverage, wellness program, fertility and family building aids, life and disability insurance, retirement savings plans with a generous 401K match, paid leave programs, paid holidays, and paid time off (PTO).

Summary / Mission

The Information Security Director leads the enterprise Data Protection, Security Architecture, and Third-Party Cyber Risk Management functions. This role owns the operating model and outcomes for protecting sensitive data across on-prem, cloud, and endpoint environments; directs a team of security architects that define and govern security architecture standards and technology reviews; and runs a scalable vendor due diligence and contract-security requirements program with clear governance and exception handling. The role also partners closely with the Incident Response (IR) team to ensure preparedness, clear reporting obligations, and effective response execution across internal and third-party events.

Reporting line & scope Reports to: CISO Teams / functions owned: Data Protection (classification, DLP, encryption, data handling rules, monitoring/response workflows) across endpoint, cloud, and on-prem.(2) Security Architecture (enterprise security architecture blueprint, patterns/standards, architecture reviews for new technologies). Third-Party Cyber Risk (vendor security due diligence, ongoing monitoring, security addendum/contract requirements, exception governance). 3rd Party Cyber Incident Response (operational oversight/enablement; define requirements, playbooks, testing, coordination across teams and vendors).

Key responsibilities

• 1) Data protection program leadership (on-prem, cloud, endpoint) Own the enterprise data protection strategy and operating model, including classification/labeling, handling rules, DLP, and measurable enforcement outcomes. Establish a sustainable classification approach (e.g., small, understandable taxonomy tied to handling expectations and controls) and ensure governance/ownership remains active over time. Implement a phased enforcement approach for DLP (visibility → user education → controlled override → targeted enforcement) to reduce false positives and operational friction. Define exception processes, review cadence, and tuning workflows so data protection does not become “set-and-forget” shelfware. Partner with IT, risk, privacy, legal, compliance, and business data owners to align protection controls to real data flows and regulatory expectations.
• 2) Security architecture leadership Lead a team of security architects responsible for the security architecture blueprint, including reference architectures, control standards, and reusable patterns. Run architecture reviews for new technologies and major changes, ensuring security requirements are measurable and implementable (and exceptions are formally governed). Ensure security architecture integrates with enterprise platforms (IAM, logging/monitoring, endpoint security, cloud controls) and supports delivery velocity with clear guardrails.
• 3) Third-party cyber risk management & due diligence Own the end-to-end vendor security assessment lifecycle: intake, risk tiering, due diligence, remediation tracking, risk acceptance, and renewal/continuous monitoring. Establish/maintain a standardized third-party security addendum and baseline contractual security requirements (with deviations handled via a formal, risk-based exception process). Ensure vendor security requirements are specific and enforceable (e.g., defined incident reporting timelines, audit rights, and consequences of non-compliance).
• 4) 3rd Party Cyber Incident response (IR) oversight and preparedness Ensure incident response capabilities are defined, tested, and integrated across internal teams and third parties, including escalation, containment, recovery, and post-incident corrective actions. Ensure contractual obligations support response needs (e.g., notification windows, root-cause analysis and corrective action expectations for vendors).

Qualifications

• Bachelor's degree in Information Security, Information Technology, Computer Science, Engineering or related field
• 10+ years in information security, including leadership over at least two of: data protection/DLP, security architecture, third-party risk, incident response.
• Experience building governance-driven security programs that balance control enforcement with operational adoption.
• Demonstrated ability to create measurable, enforceable vendor security requirements and manage exceptions via risk-based governance.
• Experience operationalizing vendor risk lifecycle activities (tiering, due diligence, remediation, acceptance, continuous monitoring).
• Strong stakeholder management across legal, privacy, compliance, IT, procurement, and business leadership.
• Experience implementing a sustainable data protection model (labels/classification + DLP tuning and rollout).
• Experience managing 3rd party cybersecurity risk program including due diligence, contract language, ongoing monitoring, and incident response.
• Cloud security architecture experience (major cloud provider environments) and endpoint data controls integration.

The duties listed above are the essential functions, or fundamental duties within the job classification. The essential functions of individual positions within the classification may differ. Texas Capital Bank may assign reasonably related additional duties to individual employees consistent with standard departmental policy.Texas Capital is an Equal Opportunity Employer.

Texas Capital is built to help businesses and their leaders. Our depth of knowledge and expertise allows us to bring the best of the big banks at a scale that makes sense for our clients, with highly experienced bankers who truly invest in people’s success — today and tomorrow. While we are rooted in core financial products, we are differentiated by our approach. Our bankers are seasoned financial experts who possess deep experience across a multitude of industries. Equally important, they bring commitment — investing the time and resources to understand our clients’ immediate needs, identify market opportunities and meet long-term objectives. At Texas Capital, we do more than build business success. We build long lasting relationships. Headquartered in Dallas with offices in Austin, Fort Worth, Houston, Richardson, Plano and San Antonio, Texas Capital was recently named the #1 most trusted bank in the country on Newsweek’s inaugural list of America’s Most Trusted Companies