To earn each difficulty mask, you need to beat every heist on the respected difficulty to unlock the mask. This includes all DLCs as well.
The Wiki also states for the difficulty mask:
These masks are unlocked by beating every mission on their respective difficulty or a harder difficulty with the exception of Lab Rats and Safe House Nightmare. They can't drop during a payday and they can't be sold. Instead, they can be returned to your mask stash for free, but any pattern, color or material as well as the customization fee to put these together will be lost.
It appears that two of the heists you do not have to do. The Steam Forum also says the Train Heist does not count either.
As a side note, I've experienced on console (prior to the free update) that these masks were locked even after beating every heist on every difficulty (I 100%ed the game and they were still locked). I'm not quite sure why they were still locked, perhaps the game was expecting the missions that the PC version of the game has and the console version does not to be beaten, making them impossible to obtain on console (pure speculation). But now that the free update is out, I haven't beaten all the new levels yet - nor do I own the DLC for some of the heist to test and see if they now unlock.