Cybersecurity Director – Data Protection, Security Architecture & Third-Party Risk

The Information Security Director for Data Protection, Security Architecture, and Third-Party Cyber Risk Management at Texas Capital Bank is responsible for building the operating model and measurable outcomes that protect sensitive information across on-prem, cloud, and endpoint environments. This role governs security architecture standards, manages vendor security risk end to end, and partners closely with incident response to ensure preparedness and effective execution.

Data Protection Strategy and Operating Model

• Own the enterprise data protection strategy and operating model, including classification and labeling, data handling rules, DLP, and measurable enforcement outcomes.
• Define and maintain a sustainable classification approach, such as a small, understandable taxonomy linked to handling expectations and controls, with active governance and ownership over time.
• Implement a phased DLP enforcement approach, including visibility, controlled user education, and targeted enforcement to reduce false positives and operational friction.
• Establish exception processes, review cadence, and tuning workflows to keep data protection program elements current and operationally effective.
• Partner with IT, risk, privacy, legal, compliance, and business data owners to align protection controls to real data flows and regulatory expectations.

Security Architecture Governance

• Lead a team of security architects responsible for the security architecture blueprint, including reference architectures, control standards, and reusable patterns.
• Run architecture reviews for new technologies and major changes to ensure security requirements are measurable, implementable, and governed through formal exception handling.
• Ensure security architecture integrates with enterprise platforms such as IAM, logging and monitoring, endpoint security, and cloud controls, while supporting delivery velocity using clear guardrails.

Third-Party Cyber Risk Management

• Own the end-to-end vendor security assessment lifecycle, including intake, risk tiering, due diligence, remediation tracking, risk acceptance, and renewal or continuous monitoring.
• Establish and maintain a standardized third-party security addendum and baseline contractual security requirements, with deviations handled through a formal, risk-based exception process.
• Ensure vendor security requirements are specific and enforceable, including defined incident reporting timelines, audit rights, and consequences for non-compliance.
• Ensure contractual obligations support response needs, including notification windows and expectations for vendor root-cause analysis and corrective actions.

Incident Response Collaboration Across Internal and Third Parties

• Ensure incident response capabilities are defined, tested, and integrated across internal teams and third parties, including escalation, containment, recovery, and post-incident corrective actions.
• Coordinate preparedness and operational expectations so response reporting obligations and execution align across internal and vendor events.

Required Qualifications

• Bachelor’s degree in Information Security, Information Technology, Computer Science, Engineering, or a related field.
• 10+ years in information security, including leadership over at least two of: data protection/DLP, security architecture, third-party risk, and incident response.
• Experience building governance-driven security programs that balance control enforcement with operational adoption.
• Demonstrated ability to create measurable, enforceable vendor security requirements and manage exceptions through risk-based governance.
• Experience operationalizing the vendor risk lifecycle, including tiering, due diligence, remediation, acceptance, and continuous monitoring.
• Strong stakeholder management across legal, privacy, compliance, IT, procurement, and business leadership.
• Experience operationalizing a sustainable data protection model, including classification and labeling plus DLP tuning and rollout.
• Experience managing third-party cybersecurity risk, including due diligence, contract language, ongoing monitoring, and incident response.
• Cloud security architecture experience in major cloud provider environments and integration of endpoint data controls.

Technologies

• DLP
• IAM

Benefits

• Health insurance coverage
• Wellness program
• Fertility and family building aids
• Life and disability insurance
• Retirement savings plans with a generous 401K match
• Paid leave programs
• Paid holidays
• Paid time off (PTO)

Reporting Line and Scope

• Reports to: CISO
• Data Protection: classification, DLP, encryption, data handling rules, and monitoring or response workflows across endpoint, cloud, and on-premises environments.
• Security Architecture: enterprise security architecture blueprint, patterns and standards, and architecture reviews for new technologies.
• Third-Party Cyber Risk: vendor security due diligence, ongoing monitoring, security addendum and contract requirements, and exception governance.
• 3rd Party Cyber Incident Response: operational oversight and enablement, including defining requirements, playbooks, testing, and coordination across teams and vendors.

Role Location and Experience Level

• Location: Richardson, TX (onsite)
• Minimum experience: 10 years