From global private banks to community lenders with a dozen branches, every bank in America faces the same regulators, the same fraud rings, and the same nation-state threats. The six CISOs below protect institutions of very different sizes, and their careers took very different routes to the job. One built the first at-sea computer emergency response team for a Navy carrier strike group and later ran cybersecurity for the IRS. Another started out writing mortgage servicing software for savings and loans in the 1980s. A third spent 25 years securing one of the nation’s largest health systems before moving to a Wisconsin bank, and a fourth has run technology and security for the same Montana bank for two decades.
Cynthia Swanson-Suarez – EVP & CISO, First Financial Bank Texas
Cynthia Swanson-Suarez started as a programmer analyst at The Newtrend Group, developing mortgage servicing software for savings and loans. At First American Financial Corporation, she managed client technology engagements before joining the three-person team that built the CISO office for First American’s information solutions group, hosting about 60 client audits a year. Over nearly ten years as VP of corporate information security at CoreLogic, she led the incident response team, managed policy compliance through an 18-month data center migration, mentored six information security managers, and built security integration plans for new acquisitions. Swanson-Suarez became EVP and CISO of First Financial Bank Texas in December 2017, establishing a vulnerability management program, running ransomware tabletop exercises for IT and executives, and reporting quarterly to the board and risk committee. She holds CRISC and CDPSE certifications.
David Stender – EVP, Enterprise Risk Officer & CISO, BankUnited
David Stender spent 26 years in the U.S. Navy as an information assurance, information warfare, and cryptologic officer. As information warfare commander and CISO for a carrier strike group, he led more than 200 personnel, was responsible for $1.5 billion in specialized equipment during wartime deployment, and implemented the first at-sea computer emergency response team program. After directing information assurance work at Perot Systems, he served as associate CIO for cybersecurity and CISO at the Internal Revenue Service, leading more than 400 employees and 200 contractors and serving as IT expert for international dialog on the Foreign Account Tax Compliance Act. As CISO and CSO of M&T Bank for eight years, he oversaw cybersecurity, financial crimes, physical security, and third-party risk, while serving on risk committees for The Clearing House and Visa. Stender joined BankUnited as CISO in 2023 and in May 2024 became EVP, enterprise risk officer, and CISO, adding BSA/AML, fraud, compliance, and business continuity to his remit.
Kevin Frinzi – CISO, Horicon Bank
Kevin Frinzi began as director of merger and acquisition EDI at The Pillsbury Company. He then spent 25 years at Advocate Aurora Health, one of the nation’s largest integrated health systems, serving as information security officer and director of health information management security and directing infrastructure, business continuity, enterprise applications, and clinical-support technology. He went on to serve as CISO and director of IT at the Dohmen Company Foundation during a major business transformation and divestiture, then as CISO of ABOUT Healthcare, where he led cybersecurity, compliance, cloud engineering, and IT for a healthcare technology company. Frinzi became CISO of Horicon Bank in 2024, directing the community bank’s security program, governance, and regulatory alignment.
Michael Tewes – EVP & CISO, Safra National Bank of New York
Michael Tewes managed network operations at Danka Business Systems for seven years before joining Marsh & McLennan, where he led global virus management and incident response as VP of information protection. As deputy CISO at The Bank of Tokyo-Mitsubishi, he managed security architecture, engineering, and operations. He spent six years leading global information security at Jefferies and five at Veeco Instruments, where he built the company’s information security program from its inception. Tewes has served as EVP and CISO of Safra National Bank of New York since 2016, protecting a private bank with more than $23 billion in client assets and offices in New York, Florida, and Latin America. He holds CISM and CRISC certifications.
Seth Decker – CTO & CISO, Bank of Bridger
Seth Decker worked as an IT specialist at Dell in Texas before joining Bank of Bridger in 2006. For more than 20 years he has led the regional bank’s technology and security as CIO, CTO, and CISO, overseeing 12 branches across two states and serving on its board. He has managed core banking system conversions and acquisitions, implemented a NIST-based cybersecurity framework, conducts internal and external IT audits and risk assessments, and oversees third-party risk management, including vendor contracts and SOC reviews.
Tim Byrd – CISO, First Citizens Bank
Tim Byrd spent 12 years in information security at Bank of America, where he managed a threat analysis and vulnerability assessment program of more than 100 professionals and led infrastructure security, from DDoS mitigation and network segmentation to a big-data cyber analytics platform. At Wells Fargo he led the bank’s information security leaders and strategic assessments. He went on to serve as CISO of TIAA, PROG Holdings, and M&T Bank before becoming CISO of First Citizens Bank in May 2026. Byrd has chaired the BITS Information Security Committee of the Financial Services Roundtable twice and the Bank Policy Institute’s BITS CISO Committee, served on the FS-ISAC board for more than four years, and sits on the board of the National Technology Security Coalition and advisory councils at NYU Tandon and UNC Charlotte.
Many Banks, One Mandate
These six CISOs show how differently banking security leaders are made. Stender brought military and federal experience to two banks, and Byrd built his career inside the largest US institutions before leading security at M&T Bank, where Stender had served before him. Swanson-Suarez and Tewes spent decades in financial services and information security, while Frinzi brought healthcare experience to a community bank and Decker has grown with a single regional bank for 20 years. Whatever the size of the institution, they share the same responsibility: keeping customers’ money and data safe.
Discover more CISOs securing their organizations:
- Built on Circuits: Electronics Manufacturing’s CISOs to Watch
- Under the Hood: Automotive Manufacturing’s Cybersecurity Leaders to Watch
- Voices From the Podium: Canada’s CISOs to Watch
- From Farm to Factory Floor: Food and Beverage Manufacturing’s CISOs to Watch
- Behind the Vault Door: The UK’s Banking CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.