Data Compliance Program Manager
- Compensation
- Not disclosed
- Location
- Kearney, Nebraska, United States
- Work setup
- Onsite
- Seniority
- Not specified
- Employment
- Full time
- Experience
- Not specified
- Category
- Project management
- Posted
Skills
Nice to have
- Working knowledge of U.S. federal and state privacy laws and enforcement; familiarity with the GDPR and other international frameworks.
- Hands-on experience with privacy operations, such as data mapping, DSR fulfillment, consent management, and privacy or data protection assessments.
- Demonstrated ability to translate legal and regulatory requirements into practical, auditable operational controls and product requirements.
- IAPP certification (CIPP/US, CIPM, or CIPT); ISACA certification (CISA or CRISC); or a project management credential (PMP, Agile, or Scrum).
- Experience at a publicly traded company, including exposure to SEC disclosure processes, SOX controls, or internal audit.
- Experience in retail, e-commerce, or other consumer-facing businesses, including loyalty programs, digital marketing, and PCI DSS environments.
- Familiarity with the NIST Privacy Framework, NIST Cybersecurity Framework, and ISO/IEC 27001 and 27701.
- Experience implementing or administering privacy management platforms (e.g., OneTrust, TrustArc, Transcend, BigID, etc.).
- Exposure to AI governance practices and frameworks, such as the NIST AI Risk Management Framework.
Full description
Summary
Working across Legal, Information Security, Information Technology (IT), and Data teams, this teammate will translate evolving privacy and data protection regulations into practical policies, product requirements, and operational controls to drive the initiatives that keep Buckle’s data practices compliant, auditable, defensible, and worthy of guest trust.
The teammate in this role owns the privacy compliance roadmap and embeds privacy by design into products, processes, and the software development lifecycle. The teammate in this role will oversee scalable privacy capabilities such as data mapping and inventory, consent and preference management, data subject request (DSR) fulfillment, and data privacy risk assessments, while serving as a key coordinator for audits, regulatory inquiries, and data incident response.
Essential Duties and Responsibilities
This description intends to describe the general nature and level of work performed by Teammates assigned to this job. It is not intended to include all duties, responsibilities, and qualifications. To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
Strategic Leadership
- Own the enterprise data compliance program strategy and multi-year roadmap, aligning priorities with regulatory requirements, business initiatives, and the Company’s risk appetite.
- Prepare program status, metrics, and risk reporting for executive leadership, and support periodic updates to other stakeholders as necessary and appropriate.
Governance and Compliance
- Establish program charters, RACI models, KPIs, and maturity assessments; manage the program backlog, timelines, budgets, and resource plans across workstreams.
- Monitor and implement practices to comply with U.S. federal and state privacy and data protection laws, including the CCPA/CPRA, the Nebraska Data Privacy Act, and other comprehensive state privacy laws, as well as COPPA, CAN-SPAM, the TCPA, state data breach notification laws, and FTC guidance on unfair or deceptive data practices.
- Draft and maintain internal privacy and data handling policies, standards, and procedures, and partner with counsel to keep external privacy notices accurate and current.
- Coordinate internal and external audits and assessments, manage evidence collection and remediation tracking, and coordinate responses to regulatory inquiries and consumer complaints related to data practices.
Risk Management
- Conduct regulatory gap assessments and translate findings into remediation plans with clear owners, deadlines, and evidence of completion.