Sr. Director of Cybersecurity

About Rack Room Shoes:

Rack Room Shoes is recognized as a footwear industry innovator and has proudly served our communities, pairing people with their favorite shoes for over 100 years. We offer a great variety of on-trend styles for women, men and children in athletic, comfort and dress categories. We pride ourselves on a delightful and trusted shopping experience for our valued customers while offering an outstanding value on a wide selection of nationally recognized brands and exclusive private labels.  We operate approximately 515 stores in 37 states.

Why Join Us?

At Rack Room Shoes, technology is a critical driver of our business success. As part of our IT team, you will play a key role in shaping the future of our enterprise data environment, supporting innovation, business intelligence, and data-driven decision-making across the organization. We value collaboration, continuous improvement, and forward-thinking solutions that enhance performance and scalability. If you are passionate about building reliable, high-performing data platforms and want to make a meaningful impact in a dynamic retail environment, we invite you to join our team and help drive our digital transformation journey.

Position Summary:

Responsible for defining, leading, and continuously improving the enterprise cybersecurity program for Rack Room Shoes. Owns cybersecurity strategy, governance, risk posture, security architecture, and cyber resilience, ensuring alignment with business priorities, regulatory requirements, and evolving threats.

Provides executive-level leadership across security operations, engineering, governance, compliance, risk management, and incident response while partnering with technology and business leaders to reduce risk and strengthen the organization’s security maturity.

Serves as the primary advisor to the CIO and executive leadership team on cybersecurity strategy, risk management, regulatory compliance, and cyber resilience. Establishes security frameworks, policies, and standards; oversees security operations and third-party partners; and guides investment decisions to protect company systems, networks, applications, customers, associates, and data assets.

Essential Functions:

• Serve as the accountable executive owner of enterprise cybersecurity risk, governance, and overall program effectiveness
• Define and execute the enterprise cybersecurity strategy, roadmap, and target maturity model
• Establish and maintain cybersecurity governance, policies, standards, and best practices
• Own the organization’s overall cyber risk posture, including identification, assessment, mitigation, and reporting of cybersecurity risks
• Provide executive-level reporting on cybersecurity posture, key risks, security metrics, and investment priorities
• Present cybersecurity strategy, risk posture, and investment recommendations to executive leadership and governance committees
• Own and lead the PCI DSS compliance program, including annual assessments, remediation efforts, audit coordination, and continuous compliance monitoring
• Ensure cybersecurity controls align with high-availability retail and eCommerce environments, balancing security with uptime and customer experience
• Oversee cybersecurity controls supporting retail store operations, point-of-sale systems, eCommerce platforms, cloud environments, corporate systems, and third-party services
• Direct security operations including monitoring, threat detection, incident response, recovery, and threat intelligence activities
• Lead crisis management efforts during significant cybersecurity incidents and coordinate cross-functional response activities
• Direct and guide security engineering, governance, and operations teams to ensure effective execution and continuous improvement
• Establish clear separation of responsibilities across security engineering, security operations, governance, risk, and compliance functions
• Oversee vulnerability management, threat detection, security monitoring, penetration testing, and enterprise remediation efforts
• Ensure continuous improvement of monitoring, detection capabilities, incident response readiness, and cyber resilience
• Define and maintain enterprise security architecture standards aligned with business and technology strategies
• Lead identity and access management (IAM) strategy, including MFA, identity governance, privileged access, and zero trust capability development
• Establish and manage third-party cybersecurity risk management processes for vendors, service providers, and technology partners
• Manage relationships with third-party security partners and ensure service effectiveness and contractual compliance
• Evaluate, approve, and oversee