Director, Information Security & Compliance

Caleres•Clayton, MO

About The Position

Caleres is seeking an analytical security leader to join its IT team. The Director, Information Security & Compliance will establish and oversee the company’s cybersecurity vision, strategy, architecture, and programs to manage business risk. The role leads the information security program and its roadmap, including policies, capabilities, budgets, investments, vendors, and resources aligned with business priorities and risk reduction. It also provides executive leadership with clear reporting on security posture, material risks, emerging threats, performance measures, investment priorities, and mitigation plans. The director establishes security architecture, control standards, and secure design requirements across cloud, applications, infrastructure, identity, and data. The role oversees regulatory, policy, audit, and compliance activities, including SOX and PCI; managed detection, incident response, and cyber resilience; third-party security risk; vulnerability management; identity and access governance; and data protection governance. The director also participates in governance for artificial intelligence and emerging technologies, assessing security, privacy, third-party, and data risks and helping define safeguards for responsible adoption. The position builds a high-performing security organization and culture through talent development, succession planning, internal partnerships, security awareness, and effective oversight of managed providers.

Requirements

Bachelor’s degree in Information Systems or a related field.
10+ years of progressive cybersecurity experience.
Prior director-level or enterprise leadership experience and responsibility for leading high-performing technical teams.
Experience leading and maturing cybersecurity programs built on NIST CSF, CIS, or similar frameworks.
Strong understanding of enterprise cybersecurity operations, EDR, network and cloud security, vulnerability management, security architecture, identity governance, SIEM, DSPM, and GRC.
Experience with incident response, including leading IR activities and managing an IR plan.
Strong communication and organizational skills, including the ability to translate security risk into concise executive-level presentations and decision-ready materials.
Collaborative, solutions-driven approach and commitment to continuous learning about emerging cybersecurity trends and technologies.

Nice To Haves

CISSP, CISM, CRISC, or a related professional certification.

Responsibilities

Lead Caleres’ information security program, strategy, and roadmap, including policies, capabilities, budget, investments, vendors, and resources aligned with business priorities and risk reduction.
Lead enterprise cybersecurity risk management and report security posture, material risks, emerging threats, performance measures, investment priorities, and mitigation plans to executive leadership.
Establish security architecture, control standards, and secure design requirements across cloud, applications, infrastructure, identity, and data.
Lead regulatory, policy, audit, and compliance activities, including SOX and PCI.
Oversee managed detection, incident response, and cyber resilience, including provider oversight, incident command, escalation, communications, business continuity, disaster recovery, backup protection, and recovery testing.
Oversee third-party security risk and vendor relationships, partnering with Legal, Internal Audit, Human Resources, and business stakeholders on regulatory obligations, remediation, and risk decisions.
Direct vulnerability management, establish remediation SLAs, and provide risk and performance reporting.
Provide governance and role oversight for identity and access management, including SAP GRC and SailPoint.
Lead data protection governance, including data security posture management, data loss prevention, privacy-aligned controls, and response to data-related incidents across cloud, collaboration, endpoint, and enterprise platforms.
Participate in artificial intelligence and emerging technology governance by assessing security, privacy, third-party, and data risks and helping define safeguards for responsible adoption.
Build a high-performing security organization and culture through talent development, succession planning, internal partnerships, security awareness, and effective oversight of managed providers.
Lead incident response activities, manage the incident response plan, and organize and conduct annual tabletop exercises.