EVP Chief Information Security Officer

First Financial Bank; United States; On-site; USD 180,000 - 260,000; Full time

Job summary

First Financial Bank is seeking an experienced Executive Vice President and Chief Information Security Officer (CISO) to lead and oversee the enterprise Information Security Program for the company and its subsidiaries. The CISO will develop strategy, governance, policies, and risk management across technology and business units.

You will report to executive management and boards, drive security awareness, incident response, IAM governance, and third-party risk oversight, while guiding

Qualifications

• Minimum of 15 years of progressively responsible information security experience, with at least 5 years in senior leadership.
• Significant banking or regulated financial-services risk experience is highly preferred.
• Strong leadership, communication, and relationship-management skills; ability to present to executive leadership and boards.

Responsibilities

• Develop, implement, and continuously improve the Enterprise Information Security Program and governance framework.
• Provide executive oversight of IAM governance and access control programs across applications, systems, and infrastructure.
• Lead reporting to executive management and board committees on information security risk, program performance, and regulatory developments.
• Oversee security awareness, incident response planning, vendor security oversight, and emerging technology governance.

Skills

Information Security Leadership

IAM governance

Risk management

Board reporting

Education

Bachelor's degree in cybersecurity

Tools

CISSP

CISM

CISA

Job description

Address We’re always looking for bright individuals to join our growing organization. As a part of the First Financial Family, we will invest in your development and provide a dynamic work environment where you’re challenged, valued and empowered every day. We strive to be the best destination for the industry’s top talent, creating a diverse, collaborative workplace that celebrates innovation and change. We are one team, working together to get things done.

Job Description: Office Location: Abilene, Texas, United States

SCOPE and Contacts

Executive Vice President and Chief Information Security Officer (CISO) is responsible for leading and overseeing the enterprise Information Security Program for First Financial Bankshares, Inc. and its subsidiaries. The CISO establishes the Company’s information security strategy, governance framework, policies, standards, risk assessment processes, security oversight, incident response capabilities, and cybersecurity resilience program.

The CISO provides independent challenge and risk-based oversight of information security activities across the Company and works closely with executive management, Technology, Operations, Enterprise Risk Management, Compliance, Legal, Internal Audit, business units, and third-party service providers. The CISO regularly reports the Company’s information security risk profile, program effectiveness, significant incidents, material control deficiencies, and remediation status to executive management and the appropriate Boards or Board committees.

ESSENTIAL FUNCTIONS

Information Security and Cybersecurity Governance

Develop, implement, maintain, and continuously improve the Company's Information Security Program. Establish and oversee information security policies, standards, procedures, and governance processes. Evaluate the effectiveness of security controls and recommend enhancements to address evolving threats and business risks. Monitor the cybersecurity threat landscape and ensure appropriate controls are implemented to safeguard Company assets. Lead enterprise cybersecurity strategy and planning activities aligned with organizational objectives and regulatory expectations.

Identity and Access Management (IAM)

Provide executive oversight of the Enterprise Identity and Access Management (IAM) Program. Oversee governance of user access across Company applications, systems, and infrastructure. Ensure appropriate processes exist for provisioning, modifying, reviewing, certifying, and revoking user access rights. Oversee user access reviews, role management, segregation of duties, authentication controls, and privileged access management practices. Collaborate with business and technology leaders to ensure access governance supports operational efficiency and risk management objectives.

Artificial Intelligence and Emerging Technology Governance

Participate as a member of the Artificial Intelligence Governance Council. Provide cybersecurity, information protection, privacy, and risk management guidance regarding the use of artificial intelligence technologies. Assess security implications and emerging risks associated with artificial intelligence, automation, and new technologies. Recommend governance practices and controls to support the secure and responsible use of emerging technologies.

Board, Committee, and Executive Reporting

Prepare and deliver risk-based reports regarding information security, cybersecurity, technology risk, and emerging threats. Provide periodic reporting to executive management, the Risk Committee of the Board of Directors, the First Technology Services Board, and the First Financial Wealth Management Board. Present cybersecurity program performance, strategic initiatives, regulatory developments, and risk exposures in a manner appropriate for executive and board audiences. Advise executive leadership and Boards regarding cybersecurity strategy, risk management decisions, and security investments.

Security Awareness and Training Program

Direct and oversee the Company's Security Awareness and Training Program. Manage enterprise-wide cybersecurity awareness initiatives designed to strengthen the organization's security culture. Oversee security awareness training, monthly security education programs, phishing awareness initiatives, and employee communications. Ensure the effectiveness of awareness efforts through metrics, reporting, and continuous improvement activities. Promote cybersecurity awareness and accountability among employees, management, and executive leadership.

Third-Party and Vendor Security Oversight

Review and evaluate the information security controls of third-party service providers, contractors, and vendors with access to Company information as requested.

Incident Response

Support the development, maintenance, and testing of cybersecurity incident response plans and procedures. Coordinate security incident preparedness activities and cybersecurity tabletop exercises. Assist in managing significant cybersecurity incidents and remediation efforts.

Security Advisory and Risk Consultation

Serve as the Company's primary information security advisor. Provide guidance regarding security risks associated with new technologies, products, services, applications, and business initiatives. Participate in technology implementation, digital transformation, cloud adoption, and change management activities to ensure appropriate security controls are incorporated. Support business units in identifying security risks and implementing appropriate safeguards.

Leadership and Administration

Lead, develop, and mentor information security personnel. Establish departmental goals, strategic initiatives, and performance expectations. Prepare and manage departmental budgets and resource planning activities. Support regulatory examinations, internal audits, external audits, and independent security assessments. Maintain professional knowledge through continuing education, industry involvement, and professional development. Actively support the Customer Service First program, support the values of the organization, and follow established policies and procedures. Perform other duties as assigned.

MINIMUM QUALIFICATIONS

Knowledge/Experience – A minimum of 15 years of progressively responsible experience in information security, cybersecurity, technology risk management, information technology, or related financial-services risk disciplines, including at least five years in a senior leadership or management capacity. Significant banking or regulated financial-services experience is highly preferred. The incumbent should demonstrate: Thorough knowledge of cybersecurity principles, technologies, and industry best practices. Strong understanding of banking operations, technology environments, regulatory requirements, and risk management frameworks. Experience overseeing Identity and Access Management governance and access control programs. Knowledge of cybersecurity governance, incident response, security awareness, business continuity, and vendor risk management. Strong leadership, analytical, communication, negotiation, and relationship management skills. The ability to communicate security-related topics to executive leadership and Boards of Directors. The ability to remain objective and effective within a diverse working environment. A comprehensive understanding of information flows, business processes, and information security risks throughout the organization.

Education

Bachelor’s degree in cybersecurity, information technology, computer science, management information systems, business, accounting, finance, risk management, or a related discipline. Substantial directly relevant experience may be considered in lieu of a specific field of study. An advanced degree is preferred but not required.

Professional Certification

A recognized information security, cybersecurity, audit, risk, or privacy certification is required or must be obtained within an established period following appointment. Relevant certifications include CISSP, CISM, CISA, CRISC, or another certification approved by the Chief Risk Officer. Continuing professional education sufficient to maintain applicable certifications is required.

Other

This position requires executive-level written and oral communication skills and the ability to present risk assessments, incidents, program results, resource needs, and recommendations clearly to executive management and the Boards of Directors.

Reporting Relationship

The CISO reports administratively to the Chief Risk Officer and has direct and unrestricted access to the Risk Committee and applicable Boards of Directors. The CISO will provide quarterly reporting to the appropriate Board committee(s) and First Technology Services Board. Reporting to other subsidiary Boards will occur as appropriate to their risk profiles and governance responsibilities. The above statements reflect the general details considered necessary to decide the principal functions of the job identified and shall not be construed as a detailed description of all work requirements that may be inherent in the job.

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities

The contractor will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor’s legal duty to furnish information. 41 CFR 60-1.35(c)

What Makes Us Unique? You.

Since 1890, First Financial has been serving the financial needs of customers in every neighborhood, just like yours. Not just through good times, but during difficult years too. We survived the Great Depression, the collapse of the Texas economy in the 1980s, and the Great Recession. Throughout it all, we remain a place of stability and trust for our customers. While other banks have come and gone, First Financial continues to grow through acquisitions, new branches, and the expansion of our services. It goes without saying, First Financial is not your everyday bank. Our “One Bank, Multiple Regions” concept combines the best of “Big Bank” customer benefits with the local decision making and involvement of a community bank. The Company includes multiple banking regions with 79 convenient locations throughout Texas, and we offer convenient banking options with a local, personal touch. And because we’re one bank, you can visit any of our locations and receive the same friendly service. Many of our employees are leaders in the community. After all, being involved with the community is an important part of who we are. Discover for yourself how at First Financial, it’s You First.