Data Compliance Program Manager

Buckle•Kearney, NE

2d•Onsite

About The Position

Working across Legal, Information Security, Information Technology (IT), and Data teams, the Data Compliance Program Manager translates evolving privacy and data protection regulations into practical policies, product requirements, and operational controls. The role owns Buckle’s privacy compliance roadmap and embeds privacy by design into products, processes, and the software development lifecycle. It oversees scalable privacy capabilities, including data mapping and inventory, consent and preference management, data subject request fulfillment, and data privacy risk assessments, while coordinating audits, regulatory inquiries, and data incident response. The position leads enterprise data compliance strategy and governance, monitors applicable privacy and data protection requirements, and maintains policies, standards, procedures, and testable controls. It works with business leaders, counsel, IT, Data, Information Security, and Finance to assess risks, manage vendors, operationalize AI governance, and support compliance involving payment card, loyalty, and rewards data. The role also oversees privacy operations, training, and privacy champions across business units. This job has no supervisory responsibilities. The teammate regularly works in an office setting with usually moderate noise. The physical demands include regularly sitting, using hands to handle or feel, and talking or hearing; occasionally standing, walking, reaching, and stooping, kneeling, crouching, or crawling; frequently lifting or moving up to 25 pounds; and operating a motor vehicle and completing errands based on business needs.

Requirements

Bachelor’s degree in business, Information Management, Compliance, Public Policy, Information Security, or a related field, or equivalent experience.
Seven or more years of experience in privacy, data protection, regulatory compliance, risk management, information security, or program management.
At least two years leading cross-functional compliance projects, programs, or initiatives.
Strong written and verbal communication skills, including the ability to present complex risk topics clearly to executive audiences.
Sound judgment and discretion in handling confidential, privileged, and sensitive information.
Ability to perform the essential duties satisfactorily, with reasonable accommodations available for individuals with disabilities.
Ability to regularly sit; use hands to finger, handle, or feel; and talk or hear; occasionally stand, walk, reach, and stoop, kneel, crouch, or crawl; frequently lift or move up to 25 pounds; and operate a motor vehicle and complete errands based on business needs.
Ability to meet the stated vision requirements, including close, distance, color, and peripheral vision, depth perception, and adjusting focus.

Nice To Haves

Working knowledge of U.S. federal and state privacy laws and enforcement, and familiarity with the GDPR and other international frameworks.
Hands-on experience with privacy operations such as data mapping, data subject request fulfillment, consent management, and privacy or data protection assessments.
Demonstrated ability to translate legal and regulatory requirements into practical, auditable operational controls and product requirements.
IAPP certification (CIPP/US, CIPM, or CIPT); ISACA certification (CISA or CRISC); or a project management credential (PMP, Agile, or Scrum).
Experience at a publicly traded company, including exposure to SEC disclosure processes, SOX controls, or internal audit.
Experience in retail, e-commerce, or other consumer-facing businesses, including loyalty programs, digital marketing, and PCI DSS environments.
Familiarity with the NIST Privacy Framework, NIST Cybersecurity Framework, and ISO/IEC 27001 and 27701.
Experience implementing or administering privacy management platforms such as OneTrust, TrustArc, Transcend, or BigID.
Exposure to AI governance practices and frameworks, such as the NIST AI Risk Management Framework.

Responsibilities

Own the enterprise data compliance program strategy and multi-year roadmap, aligning priorities with regulatory requirements, business initiatives, and the Company’s risk appetite.
Prepare program status, metrics, and risk reporting for executive leadership and other stakeholders as appropriate.
Establish program charters, RACI models, KPIs, and maturity assessments; manage program backlogs, timelines, budgets, and resource plans across workstreams.
Monitor and implement practices to comply with applicable U.S. federal and state privacy and data protection laws, regulations, and guidance.
Draft and maintain internal privacy and data handling policies, standards, and procedures, and partner with counsel to keep external privacy notices accurate and current.
Coordinate internal and external audits and assessments, manage evidence collection and remediation tracking, and coordinate responses to regulatory inquiries and consumer complaints about data practices.
Conduct regulatory gap assessments and translate findings into remediation plans with clear owners, deadlines, and evidence of completion.
Design and maintain documented, testable data compliance controls integrated with the enterprise risk management framework and, where applicable, SOX IT general controls.
Lead privacy impact and data protection assessments for products, marketing programs, vendors, and technologies, including AI, analytics, and personalization use cases.
Partner with business owners, Information Security, and Legal to assess vendor data practices, support data processing agreement negotiations, and monitor third-party compliance.
Partner with Company leaders to monitor and operationalize AI use and governance tools.
Oversee data mapping, data inventories, records of processing activities, and data retention and deletion schedules across systems and business units.
Manage data subject request processes within statutory timelines and oversee consent and preference management, including cookies, tracking technologies, opt-out preference signals, and marketing preferences.
Embed privacy by design into the software development lifecycle by translating legal requirements into product requirements, user stories, and acceptance criteria; partner with IT and Data teams on privacy tooling and automation.
Coordinate with Information Security and Finance on compliance obligations for payment card data and customer loyalty and rewards program data.
Coordinate data incident response; maintain response playbooks, facilitate tabletop exercises, and support counsel with breach notification analysis and post-incident reviews.
Develop and deliver role-based privacy and data protection training and build a network of privacy champions across business units.
Fulfill the mission statement by performing job duties with a high level of customer service while contributing to a positive team spirit.
Perform special projects and other duties as assigned.