Director, Integrated Security

Cornerstone Capital Bank; Englewood (CO); On-site; USD 150,000 - 190,000; Full time

Job summary

Cornerstone Capital Bancorp, Inc. seeks a Director, Integrated Security to lead the Bank's second line of defense for information security, IT risk, privacy, and corporate security. You will set enterprise risk frameworks, policy standards, and provide independent assurance to the Board.

The role oversees governance, risk assessment, and regulatory compliance across the organization. The position requires strong leadership, deep security risk expertise, and the ability to challenge first-line

Qualifications

• Experience leading security risk programs and second line of defense oversight.
• Ability to establish enterprise risk frameworks, policy standards and risk taxonomies.
• Familiarity with regulatory expectations (GLBA, FFIEC, NYDFS) and industry frameworks.

Responsibilities

• Establish and maintain the enterprise security risk management framework and policy standards.
• Perform independent assessments of first-line risk management and provide credible challenge.
• Monitor compliance with applicable laws, regulations, and supervisory expectations.
• Oversee incident response readiness, recovery, and post-incident reviews.
• Coordinate security metrics and reporting to executive management and the Board.

Skills

Security governance

Risk management

Independent challenge

Regulatory compliance

Security risk framework

Job description

Cornerstone Capital Bancorp, Inc., headquartered in Houston, is aTexas-basedfinancial services company dedicated to helping families, businesses, and communities thrive. Throughitsprimary subsidiary, Cornerstone Capital Bank, the organizationoperatesa community and business banking franchise alongside a premier national home lending, servicing, and home insuranceplatform-basedfinancial services company dedicated to helping families, businesses, and communities thrive.

Guided by a core Mission, Vision and Convictions statement,Cornerstoneoperates17full-servicebanking locations across major Texas markets andmore than 150mortgage offices nationwide.The companyhas servednearly700,000customersthrough its family of brands, including Cornerstone Home Lending, Roscoe Bank, Peoples Bank, Cornerstone Servicing, and Cornerstone Insurance. Supported by 1,600 team members,Cornerstoneis consistently recognized as a Fortune-certified Great Place to Work and a Top Workplace.

Formed through the combination of Cornerstone Home Lending and The Roscoe State Bank, Cornerstone brings more than a century of experience and is thehighest-capitalizednew bank in Texas history.

We honor God by using our talents to make a positive difference in the lives of our Team Members, Clients, Shareholders, Communities, and the People who provide services to us.

Who we are looking for:

The Director, Integrated Security serves as the Bank's second line of defense (2LOD) leader for security risk, providing independent oversight, credible challenge, and assurance over the first line's management of information security, IT, privacy, and corporate security risks. This role does not own or operate security controls; rather, it sets the enterprise security risk framework, defines risk appetite and policy standards, evaluates the design and operating effectiveness of first-line programs, and reports an independent view of the Bank's security risk posture to executive management, the Risk Committee, and the Board. Areas of oversight include Enterprise Security Governance and the Bank's policies, frameworks, and risk standards for Information Security, IT Risk Management, Privacy, and Corporate Security. The Director maintains functional independence from first-line operational security teams to preserve the integrity of the challenge function.

What you'll do:

Security Risk Framework and Policy:

• Establish and maintain the enterprise security risk management framework, including risk appetite statements, policies, minimum control standards, and risk taxonomies that the first line is required to implement.
• Review and challenge first-line policies, standards, and procedures to confirm alignment with regulatory expectations, the Bank's risk appetite, and industry frameworks (e.g., NIST CSF, FFIEC CAT, ISO 27001).

Independent Risk Assessment and Challenge:

• Perform independent assessments of the first line's identification, measurement, and management of security risks, including review of risk and control self-assessments (RCSAs), issue management, and key risk indicators.
• Provide credible challenge to first-line risk treatment decisions, exception requests, and risk acceptances; escape unresolved concerns through governance committees to executive management and the Board.

Regulatory and Compliance Oversight:

• Monitor and independently assess first-line compliance with applicable laws, regulations, and supervisory expectations (e.g., GLBA, FFIEC IT Handbook, NYDFS Part 500, SEC cybersecurity disclosure rules, state privacy laws); track remediation of regulatory findings and matters requiring attention (MRAs).
• Partner with the Chief Privacy Officer to provide oversight and challenge of the first line's implementation of GLBA's privacy provisions and other consumer data protection requirements.

Incident Oversight:

• Establish minimum standards for the first line's incident response, business resilience, and cyber recovery programs; review and challenge the design, testing, and continuous improvement of those programs.
• Serve in an advisory and oversight capacity during material security incidents; perform independent post-incident reviews of first-line response effectiveness and root-cause remediation, and report findings to executive management and the Board.

Security Culture and Awareness Oversight:

• Establish enterprise expectations for the first line's security awareness and role-based training programs, and independently assess their effectiveness through metrics, phishing test results, and behavioral indicators.
• Monitor and report on the enterprise security risk culture; identify gaps and recommend improvements to executive management and the Board.

Technology and Control Oversight:

• Set control objectives and minimum technical standards for security architecture and tooling; review and challenge first-line technology selection, design, and deployment decisions for alignment with risk appetite.
• Independently test and validate the design and operating effectiveness of key security controls operated by the first line; document findings and track remediation through closure.

Three Lines of Defense Coordination:

• Coordinate with first-line technology and business owners, Enterprise Risk Management, Compliance, Legal, and Internal Audit (3LOD) to ensure clear roles, avoid duplication, and maintain the independence of the second-line challenge function.
• Engage with business and technology leaders to understand strategic initiatives, provide advisory input on emerging security risks, and assess whether first-line risk management is commensurate with the risks taken.

Independent Reporting and Governance:

• Produce independent reporting on the Bank's security risk posture, control effectiveness, key risk indicators, and emerging threats for executive management, the Risk Committee, and the Board, with an unfiltered reporting line that does not require first-line approval.
• Review first-line security metrics, key risk indicators (KRIs), and breach/event trends to form an independent view of risk position relative to appetite.

Business Continuity Ownership:

• Develop and maintain business continuity and resiliency plans.
• Conduct business impact analyses and continuity risk assessments.
• Coordinate continuity testing, exercises, and corrective actions.
• Maintain business continuity governance, reporting, and documentation