Cybersecurity Director – Data Protection, Security Architecture & Third-Party Risk

The Information Security Director for Data Protection, Security Architecture, and Third-Party Cyber Risk Management at Texas Capital Bank is responsible for building the operating model and measurable outcomes that protect sensitive information across on-prem, cloud, and endpoint environments. This role governs security architecture standards, manages vendor security risk end to end, and partners closely with incident response to ensure preparedness and effective execution.

• Own the enterprise data protection strategy and operating model, including classification and labeling
  , data handling rules,
  DLP
  , and measurable enforcement outcomes.
• Define and maintain a sustainable classification approach, such as a small, understandable taxonomy linked to handling expectations and controls, with active governance and ownership over time.
• Implement a phased DLP enforcement approach, including visibility, controlled user education, and targeted enforcement to reduce false positives and operational friction.
• Establish exception processes, review cadence, and tuning workflows to keep data protection program elements current and operationally effective.
• Partner with IT, risk, privacy, legal, compliance, and business data owners to align protection controls to real data flows and regulatory expectations.

• Lead a team of security architects responsible for the security architecture blueprint, including reference architectures
  , control standards, and reusable patterns.
• Run architecture reviews for new technologies and major changes to ensure security requirements are measurable, implementable, and governed through formal exception handling.
• Ensure security architecture integrates with enterprise platforms such as IAM
  , logging and monitoring, endpoint security, and cloud controls, while supporting delivery velocity using clear guardrails.

• Own the end-to-end vendor security assessment lifecycle, including intake, risk tiering, due diligence, remediation tracking, risk acceptance, and renewal or continuous monitoring.
• Establish and maintain a standardized third-party security addendum and baseline contractual security requirements, with deviations handled through a formal, risk-based exception process.
• Ensure vendor security requirements are specific and enforceable, including defined incident reporting timelines, audit rights, and consequences for non-compliance.
• Ensure contractual obligations support response needs, including notification windows and expectations for vendor root-cause analysis and corrective actions.

• Ensure incident response capabilities are defined, tested, and integrated across internal teams and third parties, including escalation, containment, recovery, and post-incident corrective actions.
• Coordinate preparedness and operational expectations so response reporting obligations and execution align across internal and vendor events.

• Bachelor’s degree in Information Security, Information Technology, Computer Science, Engineering, or a related field.
• 10+ years in information security, including leadership over at least two of: data protection/DLP, security architecture, third-party risk, and incident response.
• Experience building governance-driven security programs that balance control enforcement with operational adoption.
• Demonstrated ability to create measurable, enforceable vendor security requirements and manage exceptions through risk-based governance.
• Experience operationalizing the vendor risk lifecycle, including tiering, due diligence, remediation, acceptance, and continuous monitoring.
• Strong…