Sr IT Security Engineer

We need to output HTML fragment with sections only where content exists. Use

for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to parse the posting. The posting includes: - Intro about company (Cornerstone Capital Bancorp...). That's "About the role"? Actually "About the role" is typical heading for description of role/company. We'll put company description under About the role. - "Who we are looking for: The Senior Security Engineer serves as a senior cybersecurity resource ..." That's description of role; could be part of About the role or Responsibilities? Usually "Who we are looking for" is role summary. We'll include in About the role. - Then "What you'll do: General Responsibilities & Expectations" followed by bullet list of responsibilities (Security Assurance & Risk Management, Security Engineering & Automation, etc). That's Responsibilities. - Then "What you’ll need to be successful:" includes bullet list of qualifications (Bachelor's degree, experience, etc). That's Requirements/Qualifications/Skills. We need to decide which headings to use. The instruction: use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We can choose appropriate ones. Likely we need Requirements (education/experience), Qualifications (maybe certifications), Skills (technical). But we have only one list of needed items. Could split into Requirements (education/experience) and Skills (technical knowledge). Let's parse: "What you’ll need to be successful: Bachelor’s degree in information technology, Cybersecurity, Computer Science, or related field preferred. Experience working within banking, financial services, mortgage lending, fintech, or other highly regulated industries. Working knowledge of FFIEC guidance, banking regulatory expectations, and cybersecurity requirements applicable to financial institutions. Familiarity with FDIC examinations, internal audits, external audits, and cybersecurity control assessments. Strong understanding of the NIST Cybersecurity Framework (CSF), CIS Controls, and risk-based cybersecurity programs. Familiarity with AI governance, AI risk management concepts, and the secure adoption of emerging technologies. 5+ years of experience in cybersecurity, informatio" It cuts off at "informati o". Probably continues "information security" etc. We'll keep as is. Thus we can have: - About the role: company description + role summary. - Responsibilities: list of duties (the bullet points under "What you'll do:"). - Requirements: education and experience (Bachelor's degree, 5+ years experience, etc). Could also include "Experience working within banking..." etc. - Skills: technical knowledge (FFIEC, NIST, AI governance, etc). Could also include "Familiarity with FDIC examinations..." maybe skill. We need to avoid creating sections with placeholder text. We have content for each. We must not include Benefits, Pay, Schedule as not present. We must not repeat job title as heading. We must not include Job ID etc. We must output only HTML fragment. We need to use

for each section heading. Inside sections, use

for prose,

• for lists. We need to preserve all substantive information; do not invent or summarize away detail. We must remove boilerplate etc. The posting includes some repeated sentences like "dedicated to helping families, businesses, and communities thrive." appears twice; we should keep only once? The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. Remove duplicated lines. So we should deduplicate repeated sentences. The intro has duplicated phrase: "Cornerstone Capital Bancorp, Inc., headquartered in Houston, is a Texas-based financial services company dedicated to helping families, businesses, and communities thrive. Through its primary subsidiary, Cornerstone Capital Bank, the organization operates a community and business banking franchise alongside a premier national home lending, servicing, and home insurance platform-based financial services company dedicated to helping families, businesses, and communities thrive." There's duplication of the dedication phrase. We should keep only one occurrence. Also later: "Guided by a core Mission, Vision and Convictions statement, Cornerstone operates 17 full-service banking locations across major Texas markets and more than 150 mortgage offices nationwide. The company has served nearly 700,000 customers through its family of brands, including Cornerstone Home Lending, Roscoe Bank, Peoples Bank, Cornerstone Servicing, and Cornerstone Insurance. Supported by 1,600 team members, Cornerstone is consistently recognized as a Fortune-certified Great Place to Work® and a Top Workplace." Then later: "Formed through the combination of Cornerstone Home Lending and The Roscoe State Bank, Cornerstone brings more than a century of experience and is the highest-capitalized new bank in Texas history. We honor God by using our talents to make a positive difference in the lives of our Team Members, Clients, Shareholders, Communities, and the People who provide services to us." We should keep all that but remove duplicated "dedicated to helping families, businesses, and communities thrive." Keep one. Now "Who we are looking for: The Senior Security Engineer serves as a senior cybersecurity resource responsible for supporting and enhancing the organization's security program across security architecture, emerging technology and AI reviews, Identity and Access Management (IAM) governance, vulnerability management, and third-party security. Reporting directly to the Chief Information Security Officer (CISO), this role partners with technology and business stakeholders to identify, assess, mitigate, and validate cybersecurity risks and security controls while ensuring alignment with organizational security objectives and regulatory requirements.The role also supports security assurance, control effectiveness, remediation validation, security engineering, automation, and continuous improvement initiatives designed to strengthen the organization's overall security posture. Working closely with the Head of IAM and other security and technology leaders, the Senior Security Engineer provides oversight and verification of security controls, conducts security assessments, and supports cybersecurity risk management, compliance, and resilience efforts within a highly regulated banking environment.The ideal candidate brings strong technical expertise, sound risk-based judgment, a collaborative mindset, and the ability to translate cybersecurity requirements into practical and sustainable solutions. Experience within financial services is preferred, including familiarity with FFIEC guidance, NIST Cybersecurity Framework principles, and regulatory examination preparedness" That's a paragraph; we can keep as prose. Now "What you'll do: General Responsibilities & Expectations" then list items each with a bold heading? The text includes headings like "Security Assurance & Risk Management – Assess security controls, identify risks and gaps, and support remediation and validation activities to promote effective and sustainable security practices." etc. We need to turn each into list items. The list includes many items; we should preserve each as
• . The headings within each item (like "Security Assurance & Risk Management –") can be kept as part of the li text. We need to ensure we don't lose any. Let's extract the responsibilities list: From the text after "What you'll do: General Responsibilities & Expectations" we have: Security Assurance & Risk Management – Assess security controls, identify risks and gaps, and support remediation and validation activities to promote effective and sustainable security practices. Security Engineering & Automation – Leverage security technologies, engineering practices, and automation to strengthen controls, improve efficiency, and reduce reliance on manual processes. Security Monitoring & Reporting – Support security metrics, reporting, and monitoring activities to provide visibility into security posture, control effectiveness, and emerging risks. Incident Response & Resilience – Participate in cybersecurity incident response, investigations, exercises, lessons learned, and initiatives that strengthen organizational resilience. Security Governance & Standards – Contribute to the development and maintenance of security standards, procedures, and technical guidance aligned with business objectives, regulatory expectations, and industry practices. Cross-Functional Partnership – Serve as a senior security advisor and collaborate with Technology, business, Risk, Compliance, Audit, and other stakeholders to identify and address cybersecurity risks. Phishing - Lead the enterprise phishing awareness program by conducting monthly phishing simulation campaigns, tracking and reporting key performance metrics, identifying user risk trends, and driving continuous improvement in employee cybersecurity awareness and resilience. Security Architecture, Emerging Technology & AI Reviews Serve as a trusted security advisor for enterprise technology initiatives, strategic projects, and business innovation efforts. Conduct security architecture reviews for applications, infrastructure, cloud services, SaaS platforms, AI-enabled solutions, and third-party technologies. Partner with architects, developers, engineers, project managers, and business stakeholders to identify, mitigate, and validate security requirements throughout solution design, implementation, and ongoing operation. Review proposed solutions for secure authentication, authorization, encryption, data protection, logging, monitoring, resiliency, and recovery requirements. Assess emerging technologies, including artificial intelligence (AI), generative AI, machine learning platforms, and AI-enabled business solutions, to ensure appropriate security controls, governance requirements, and data protection measures are established and maintained throughout the technology lifecycle. Evaluate AI-related risks including unauthorized data exposure, excessive permissions, third-party AI integrations, sensitive data protection, model governance considerations, and regulatory compliance implications. Provide guidance aligned with Zero Trust principles, secure-by-design methodologies, banking regulatory expectations, and industry best practices. Participate in AI governance discussions and provide security recommendations for the adoption of emerging technologies. Support the development, maintenance, and continuous improvement of security standards, architectural guidance, and technology control requirements. Validate that key security requirements and controls are appropriately implemented and operating as intended. Participate in vendor evaluations, technology assessments, and project planning activities to ensure security requirements are incorporated early in the project lifecycle. IAM – Governance, Oversight & Verification Primarily support the organization's Identity and Access Management (IAM) program in partnership with the Head of IAM. Provide second-line security oversight and independent verification of key cybersecurity controls, including IAM, privileged access, authentication, vulnerability management, and third-party security controls. Administer and oversee identity lifecycle processes, including onboarding, transfers, role changes, and offboarding activities. Support and verify role-based access controls (RBAC), privileged access controls, and segregation of duties requirements. Support Privileged Access Management (PAM) solutions and privileged account governance activities. Manage and support authentication technologies including Single Sign-On (SSO), Multi-Factor Authentication (MFA), Conditional Access, and identity federation. Perform independent security control validation and testing to assess design effectiveness, implementation, and sustained operating effectiveness. Validate remediation activities end-to-end, including confirmation that changes have been implemented across affected systems, processes, and procedures. Conduct periodic user access reviews and privileged access reviews. Support Microsoft Entra ID, Active Directory, and related identity platforms. Assist with audit requests, regulatory examinations, and control assessments related to identity and access management. Support the tracking, validation, and closure of cybersecurity audit, assessment, and control findings, including validation that corrective actions address the underlying control deficiency and not solely the individual exception identified Develop and maintain cybersecurity metrics, key risk indicators (KRIs), and key performance indicators (KPIs) to measure control effectiveness, remediation progress, risk exposure, and security program maturity. Prepare management-level reporting on cybersecurity risks, control effectiveness, remediation status, and emerging threats. Identify opportunities to improve identity governance, automation, operational efficiency, and security effectiveness. Vulnerability Management & Third-Party Security Lead enterprise vulnerability management activities, including identification, risk-based prioritization, remediation tracking, validation, and reporting across infrastructure, cloud, applications, and technology environments. Establish and apply risk-based vulnerability prioritization using asset criticality, business impact, exploitability, threat intelligence, exposure, and the presence of compensating controls. Partner with infrastructure, cloud, application, engineering, and technology teams to drive timely remediation of vulnerabilities and reduce organizational exposure. Review and assess findings from vulnerability assessments, penetration tests, red team exercises, security assessments, and other technical security testing activities. Monitor remediation performance, vulnerability aging, remediation SLAs, recurring findings, and risk trends; provide meaningful metrics and reporting to security leadership and governance committees. Manage vulnerability-related exceptions, risk acceptances, and compensating controls, ensuring risks are appropriately documented, reviewed, and tracked through resolution. Incorporate threat intelligence and emerging threat activity into vulnerability prioritization and remediation decisions, with heightened focus on actively exploited and