Director, Integrated Security

Cornerstone Capital Bank

. Establish and maintain the enterprise security risk management framework, including risk appetite statements, policies, minimum control standards, and risk taxonomies .

Posted 11/3/2026full-timeUnited StatesLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expert knowledge in enterprise risk management frameworks and regulatory expectations, with a strong ability to perform independent assessments and provide credible challenges to risk decisions. Proficient in developing and maintaining business continuity plans and security risk reporting for executive management.

Highest-signal resume keywords

Enterprise Risk Management FrameworksRegulatory Compliance (FFIEC, NIST, NYDFS)Information Security Risk ManagementCISSP CertificationAnalytical Reasoning and Problem-Solving

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Risk Appetite StatementsIndependent Risk AssessmentsIncident Response StandardsBusiness Continuity PlanningSecurity Control TestingRegulatory Findings RemediationKey Risk IndicatorsContinuous Improvement ProgramsCrisis Response CoordinationBusiness Impact Analysis

Soft Skills

Strong Analytical ReasoningProblem-Solving SkillsOral and Written Presentation SkillsAbility to Work IndependentlyMultitasking and Deadline Management

Tools & Technologies

Microsoft Office SuiteSecurity Risk Reporting ToolsRisk Management SoftwareIncident Management SystemsCompliance Tracking Tools

Certifications & Qualifications

CISSPCRISCCISACISM

Industry Keywords

Financial ServicesThree-Lines-of-DefenseRegulatory OversightOperational Risk ManagementBank Protection Act

About the role

Key responsibilities & impact

Establish and maintain the enterprise security risk management framework, including risk appetite statements, policies, minimum control standards, and risk taxonomies
Review and challenge first-line policies, standards, and procedures for regulatory, risk appetite, and industry-framework alignment
Perform independent assessments of first-line security risk identification, measurement, and management
Review RCSAs, issue management, and key risk indicators
Provide credible challenge to risk treatment decisions, exception requests, and risk acceptances
Escalate unresolved concerns to governance committees, executive management, and the Board
Monitor and independently assess compliance with applicable laws, regulations, and supervisory expectations
Track remediation of regulatory findings and matters requiring attention
Oversee and challenge implementation of privacy and consumer data protection requirements
Establish standards for incident response, business resilience, and cyber recovery programs
Review program design, testing, and continuous improvement
Advise during material security incidents and conduct independent post-incident reviews
Establish expectations for security awareness and role-based training programs
Assess training effectiveness through metrics, phishing results, and behavioral indicators
Set control objectives and minimum technical standards for security architecture and tooling
Review and challenge technology selection, design, and deployment decisions
Independently test and validate key security controls and track remediation
Coordinate with first-line owners, Enterprise Risk Management, Compliance, Legal, and Internal Audit
Produce independent security risk reporting for executive management, the Risk Committee, and the Board
Develop and maintain business continuity and resiliency plans
Conduct business impact analyses and continuity risk assessments
Coordinate continuity testing, exercises, and corrective actions
Maintain continuity governance, reporting, and documentation
Lead crisis response and recovery coordination during disruptions
Partner with business units and vendors to strengthen operational resilience
Deliver business continuity training and awareness programs
Provide oversight of the Bank Protection Officer function and compliance with the Bank Protection Act and 12 CFR Part 21
Deliver an independent Annual Security Risk Report to the Board
Advise on security awareness and training curriculum
Provide second-line governance perspective on enterprise security and resilience initiatives
Perform other duties as assigned

Requirements

What you’ll need

Minimum of 10 years of experience in information security, technology risk, or operational risk management within the Financial Services sector
At least 5 years in a second line of defense, risk oversight, or audit capacity
Minimum of 5 years of mid- to large-bank experience
Direct interaction with regulators (OCC, FRB, FDIC, NYDFS, or state banking departments) and the Board or its Risk Committee
Bachelor’s Degree preferred
Expert knowledge of three-lines-of-defense risk governance
Expert knowledge of enterprise risk management frameworks
Expert knowledge of regulatory expectations, including FFIEC IT Handbook, NIST CSF, NYDFS Part 500, GLBA, and SR Letters
Knowledge of independent challenge and effective challenge principles
Strong analytical reasoning, problem-solving, and critical thinking skills
Strong computer and organizational skills
Strong oral and written presentation skills
Ability to work independently with a multi-level team
Ability to multitask and meet deadlines
Strong proficiency with Microsoft Office (Word, Excel, Outlook, etc.)
Current CISSP preferred certification
Current CRISC preferred certification
CISA, CISM, or equivalent risk/audit certification preferred

Benefits

Comp & perks

Medical benefits
Dental benefits
Vision benefits
Accidental Death benefits
Long-Term Disability benefits
Short-Term Disability benefits
FSA
HSA
401K
Basic Life benefits
Voluntary Life benefits
Paid Parental Leave
Performance-based bonus opportunity
Investment in employee development and growth