Data Compliance Program Manager

The Buckle, Inc.•Kearney, NE

About The Position

The Data Compliance Program Manager works across Legal, Information Security, Information Technology, and Data teams to translate evolving privacy and data protection regulations into practical policies, product requirements, and operational controls. The role owns Buckle’s privacy compliance roadmap and embeds privacy by design into products, processes, and the software development lifecycle. It oversees scalable privacy capabilities such as data mapping and inventory, consent and preference management, data subject request fulfillment, and privacy risk assessments, and coordinates audits, regulatory inquiries, and data incident response. The position leads the enterprise data compliance strategy and roadmap, establishes program governance and reporting, monitors privacy and data protection requirements, and maintains internal policies and controls. It assesses compliance risks, vendors, products, technologies, and AI use cases; coordinates privacy operations and incident response; and develops training and a network of privacy champions. This job has no supervisory responsibilities.

Requirements

Bachelor’s degree in business, Information Management, Compliance, Public Policy, Information Security, or a related field, or equivalent experience.
Seven or more years of experience in privacy, data protection, regulatory compliance, risk management, information security, or program management.
At least two years leading cross-functional compliance projects, programs, or initiatives.
Strong written and verbal communication skills, including the ability to present complex risk topics clearly to executive audiences.
Sound judgment and discretion in handling confidential, privileged, and sensitive information.
Ability to perform the essential duties satisfactorily, with reasonable accommodations available for individuals with disabilities.

Nice To Haves

Working knowledge of U.S. federal and state privacy laws and enforcement; familiarity with the GDPR and other international frameworks.
Hands-on experience with privacy operations such as data mapping, data subject request fulfillment, consent management, and privacy or data protection assessments.
Demonstrated ability to translate legal and regulatory requirements into practical, auditable operational controls and product requirements.
IAPP certification (CIPP/US, CIPM, or CIPT), ISACA certification (CISA or CRISC), or a project management credential (PMP, Agile, or Scrum).
Experience at a publicly traded company, including exposure to SEC disclosure processes, SOX controls, or internal audit.
Experience in retail, e-commerce, or other consumer-facing businesses, including loyalty programs, digital marketing, and PCI DSS environments.
Familiarity with the NIST Privacy Framework, NIST Cybersecurity Framework, and ISO/IEC 27001 and 27701.
Experience implementing or administering privacy management platforms such as OneTrust, TrustArc, Transcend, or BigID.
Exposure to AI governance practices and frameworks such as the NIST AI Risk Management Framework.

Responsibilities

Own the enterprise data compliance program strategy and multi-year roadmap, aligning priorities with regulatory requirements, business initiatives, and the Company’s risk appetite.
Prepare program status, metrics, and risk reporting for executive leadership and other stakeholders.
Establish program charters, RACI models, KPIs, and maturity assessments; manage program backlogs, timelines, budgets, and resource plans across workstreams.
Monitor and implement practices to comply with applicable U.S. federal and state privacy and data protection laws, regulations, and guidance.
Draft and maintain internal privacy and data handling policies, standards, and procedures, and work with counsel to keep external privacy notices accurate and current.
Coordinate internal and external audits and assessments, manage evidence collection and remediation tracking, and coordinate responses to regulatory inquiries and consumer complaints related to data practices.
Conduct regulatory gap assessments and translate findings into remediation plans with owners, deadlines, and evidence of completion.
Design and maintain documented, testable data compliance controls integrated with enterprise risk management and, where applicable, SOX IT general controls.
Lead privacy impact and data protection assessments for products, marketing programs, vendors, and technologies, including AI, analytics, and personalization use cases.
Partner with business owners, Information Security, and Legal to assess vendor data practices, support data processing agreement negotiations, and monitor third-party compliance.
Partner with Company leaders to monitor and operationalize artificial intelligence use and governance tools.
Oversee data mapping, data inventory, records of processing activities, and data retention and deletion schedules across systems and business units.
Manage data subject request processes within statutory timelines and oversee consent and preference management, including cookies, tracking technologies, opt-out preference signals, and marketing preferences.
Embed privacy by design into the software development lifecycle by translating legal requirements into product requirements, user stories, and acceptance criteria; partner with IT and Data teams on privacy tooling and automation.
Coordinate with Information Security and Finance on compliance obligations for payment card data and customer loyalty and rewards program data.
Coordinate data incident response, maintain response playbooks, facilitate tabletop exercises, and support counsel with breach notification analysis and post-incident reviews.
Develop and deliver role-based privacy and data protection training and build a network of privacy champions across business units.
Perform assigned duties with a high level of customer service, contribute to a positive team spirit, and undertake special projects and other assigned duties.