Director, Integrated Security

Cornerstone Capital Bank; Houston (TX); Presencial; USD 180.000 - 240.000; Jornada completa

Descripción de la vacante

Cornerstone Capital Bancorp, Inc. in Houston seeks a Director, Integrated Security to act as the Bank's second line of defense for security risk. You will provide independent oversight of information security, IT, privacy, and corporate security risks.

You will set risk framework and policy standards, challenge first-line programs, report to the Board, and drive incident response, business continuity, and security culture across the organization.

Responsabilidades

• Establish and maintain the enterprise security risk management framework, including risk appetite statements, policies, minimum control standards, and risk taxonomies.
• Review and challenge first-line policies, standards, and procedures to confirm alignment with regulatory expectations and risk appetite.
• Perform independent assessments of first-line identification, measurement, and management of security risks, including RCSAs and KRIs.
• Provide credible challenge to risk treatment decisions, escalation paths, and governance to the Board.
• Monitor first-line compliance with GLBA, FFIEC IT Handbook, NYDFS Part 500, and SEC cyber rules; track MRAs.
• Partner with the Chief Privacy Officer to oversee GLBA privacy provisions and consumer data protection.
• Establish minimum standards for incident response, business continuity, and cyber recovery programs; oversee testing and remediation.
• Advise and report on material security incidents; conduct post-incident reviews for management and the Board.
• Set enterprise expectations for security awareness training and measure program effectiveness.
• Coordinate security risk governance with 3LOD, ensuring independence of the challenge function.
• Independently test and validate the design and operating effectiveness of key security controls.
• Develop and maintain business continuity governance, BIA, and continuity testing programs.
• Engage with tech and business leaders on strategic initiatives to align risk with business goals.
• Produce independent reporting on security posture, KRIs, and threats for executive leadership and the Board.

Descripción del empleo

Cornerstone Capital Bancorp, Inc., headquartered in Houston, is aTexas-basedfinancial services company dedicated to helping families, businesses, and communities thrive. Throughitsprimary subsidiary, Cornerstone Capital Bank, the organizationoperatesa community and business banking franchise alongside a premier national home lending, servicing, and home insuranceplatform-basedfinancial services company dedicated to helping families, businesses, and communities thrive.

Guided by a core Mission, Vision and Convictions statement,Cornerstoneoperates17full-servicebanking locations across major Texas markets andmore than 150mortgage offices nationwide.The companyhas servednearly700,000customersthrough its family of brands, including Cornerstone Home Lending, Roscoe Bank, Peoples Bank, Cornerstone Servicing, and Cornerstone Insurance. Supported by 1,600 team members,Cornerstoneis consistently recognized as a Fortune-certified Great Place to Work and a Top Workplace.

Formed through the combination of Cornerstone Home Lending and The Roscoe State Bank, Cornerstone brings more than a century of experience and is thehighest-capitalizednew bank in Texas history.

We honor God by using our talents to make a positive difference in the lives of our Team Members, Clients, Shareholders, Communities, and the People who provide services to us.

Who we are looking for:

The Director, Integrated Security serves as the Bank's second line of defense (2LOD) leader for security risk, providing independent oversight, credible challenge, and assurance over the first line's management of information security, IT, privacy, and corporate security risks. This role does not own or operate security controls; rather, it sets the enterprise security risk framework, defines risk appetite and policy standards, evaluates the design and operating effectiveness of first-line programs, and reports an independent view of the Bank's security risk posture to executive management, the Risk Committee, and the Board. Areas of oversight include Enterprise Security Governance and the Bank's policies, frameworks, and risk standards for Information Security, IT Risk Management, Privacy, and Corporate Security. The Director maintains functional independence from first-line operational security teams to preserve the integrity of the challenge function.

What you'll do:

Security Risk Framework and Policy:

• Establish and maintain the enterprise security risk management framework, including risk appetite statements, policies, minimum control standards, and risk taxonomies that the first line is required to implement.
• Review and challenge first-line policies, standards, and procedures to confirm alignment with regulatory expectations, the Bank's risk appetite, and industry frameworks (e.g., NIST CSF, FFIEC CAT, ISO 27001).

Independent Risk Assessment and Challenge:

• Perform independent assessments of the first line's identification, measurement, and management of security risks, including review of risk and control self-assessments (RCSAs), issue management, and key risk indicators.
• Provide credible challenge to first-line risk treatment decisions, exception requests, and risk acceptances; escape unresolved concerns through governance committees to executive management and the Board.

Regulatory and Compliance Oversight:

• Monitor and independently assess first-line compliance with applicable laws, regulations, and supervisory expectations (e.g., GLBA, FFIEC IT Handbook, NYDFS Part 500, SEC cybersecurity disclosure rules, state privacy laws); track remediation of regulatory findings and matters requiring attention (MRAs).
• Partner with the Chief Privacy Officer to provide oversight and challenge of the first line's implementation of GLBA's privacy provisions and other consumer data protection requirements.

Incident Oversight:

• Establish minimum standards for the first line's incident response, business resilience, and cyber recovery programs; review and challenge the design, testing, and continuous improvement of those programs.
• Serve in an advisory and oversight capacity during material security incidents; perform independent post-incident reviews of first-line response effectiveness and root-cause remediation, and report findings to executive management and the Board.

Security Culture and Awareness Oversight:

• Establish enterprise expectations for the first line's security awareness and role-based training programs, and independently assess their effectiveness through metrics, phishing test results, and behavioral indicators.
• Monitor and report on the enterprise security risk culture; identify gaps and recommend improvements to executive management and the Board.

Technology and Control Oversight:

• Set control objectives and minimum technical standards for security architecture and tooling; review and challenge first-line technology selection, design, and deployment decisions for alignment with risk appetite.
• Independently test and validate the design and operating effectiveness of key security controls operated by the first line; document findings and track remediation through closure.

Three Lines of Defense Coordination:

• Coordinate with first-line technology and business owners, Enterprise Risk Management, Compliance, Legal, and Internal Audit (3LOD) to ensure clear roles, avoid duplication, and maintain the independence of the second-line challenge function.
• Engage with business and technology leaders to understand strategic initiatives, provide advisory input on emerging security risks, and assess whether first-line risk management is commensurate with the risks taken.

Independent Reporting and Governance:

• Produce independent reporting on the Bank's security risk posture, control effectiveness, key risk indicators, and emerging threats for executive management, the Risk Committee, and the Board, with an unfiltered reporting line that does not require first-line approval.
• Review first-line security metrics, key risk indicators (KRIs), and breach/event trends to form an independent view of risk position relative to appetite.

Business Continuity Ownership:

• Develop and maintain business continuity and resiliency plans.
• Conduct business impact analyses and continuity risk assessments.
• Coordinate continuity testing, exercises, and corrective actions.
• Maintain business continuity governance, reporting, and documentation