Group Chief Information Security Officer

Global Security Strategy

• Define and execute a unified cybersecurity strategy that supports the business objectives of both B&N and Waterstones.
• Lead the development and implementation of security policies, standards, and procedures that align with local regulations and best practices.
• Serve as a trusted advisor to executive leadership and Board of Directors for both organizations.

Security Operations & Incident Response Leadership

• Lead the enterprise cybersecurity incident response and crisis management program, coordinating cross-functional response activities during major cyber incidents, ransomware events, operational disruptions, and data breaches.
• Act as the primary technical contact with external crisis response agencies, cyber insurance providers, legal counsel, forensic investigators, regulators, and law enforcement agencies during significant cybersecurity incidents.
• Drive the continuous maturation of the organization’s cyber resilience capabilities, including incident response planning, ransomware preparedness, disaster recovery, business continuity, tabletop exercises, and enterprise recovery strategies.
• Establish and maintain enterprise-wide cyber incident response standards, escalation procedures, communication protocols, and post-incident review processes to improve organizational readiness and operational resilience.
• Direct 24/7 global security operations, including monitoring, detection, and response to security incidents.

Technology & Infrastructure Security

• Leverage AI to improve detection, response, and scale.
• Ensure security is embedded in infrastructure, applications, cloud environments, and software platforms.
• Drive Zero Trust adoption, identity and access management, and secure data handling practices across both organizations.
• Oversee regular penetration testing, vulnerability assessments, and third-party risk management.

Team Leadership & Development

• Lead and foster collaboration between the B&N and Waterstones Information Security teams.
• Recruit, mentor, and retain top cybersecurity talent.
• Directs work and ensures appropriate performance levels of all Security team members across Waterstones and B&N, working together with the senior leadership team to create a performance-based culture.
• Partner with IT, Legal, Risk, HR, and other business units to ensure a holistic approach to Information Security.

Executive Leadership & Cybersecurity Influence

• Serve as a visible and influential cybersecurity leader across both organizations, representing the Information Security function internally and externally.
• Champion a strong culture of security awareness at all levels of the organization and across both businesses.
• Act as the public and internal face of the cybersecurity function, partnering with executive leadership, board members, auditors, and external partners to communicate the organization’s security vision and maturity.

AI-Enhanced Cyber Defense & Governance

• Leverage AI to improve detection, response, and scale.
• Automate incident triage and response (SOAR + AI).
• Enhance phishing and fraud detection using ML models.
• Collaborate with HR and Legal to define AI security policies and acceptable use standards.
• Classify and approve AI tools and vendors.
• Align with emerging regulatory frameworks (EU AI Act, etc.).
• Prevent data leakage into external AI platforms.
• Enforce data classification and masking for AI use.
• Monitor environment for unauthorized use of enterprise data in AI tools.
• Assess AI capabilities in vendor platforms.
• Prepare For And Defend Against AI-generated phishing (highly personalized)Deepfake-based social engineeringAutomated vulnerability discovery by attackers
• Update training and awareness programs accordingly.
• Utilize AI to reduce reliance on manual Tier 1/2 SOC work.
• Shift talent toward engineering, threat hunting, and strategy.
• Integrate AI into security tooling stack (SIEM, EDR, XDR).

Data Security & Protection

• Define and enforce enterprise data security standards, policies, and controls to ensure the confidentiality, integrity, and availability of corporate and customer data.
• Establish data classification standards and ensure data is appropriately categorized, protected, retained, archived, and disposed of based on business and regulatory requirements.
• Oversee encryption standards and key management practices for data at rest, in transit, and within cloud environments.
• Ensure appropriate access controls, and privilege security models are implemented across enterprise platforms and data repositories.
• Partner with Legal, Compliance, and technology teams to ensure adherence to data privacy and regulatory requirements, including GDPR, PCI-DSS, SOX, CCPA, and other relevant industry standards.
• Develop and maintain Data Loss Prevention (DLP) strategies and monitoring capabilities to reduce the risk of unauthorized disclosure or exfiltration of sensitive information.
• Support the development of enterprise-wide awareness and training programs related to data handling, privacy, cybersecurity, and acceptable AI usage practices.

Third-Party & Supplier Risk Governance

• Establish third-party cybersecurity risk management program to assess, monitor, and mitigate risks associated with vendors, cloud providers, SaaS platforms, outsourced service providers, and strategic technology partners.
• Define security governance standards and due diligence processes for vendor onboarding, contract reviews, system integrations, and vendor risk assessments.
• Oversee continuous monitoring and risk evaluation of critical third-party providers, including incident response coordination, security assessments, penetration testing, and remediation monitoring if needed.
• Develop governance frameworks and contingency strategies to reduce operational, financial, and reputational risk associated with third-party cyber incidents, software supply chain compromise, and critical vendor outages.

Regulatory & Audit Compliance Responsibilities

• Lead the information security compliance program to ensure alignment with applicable regulatory, legal, and industry requirements across the organization, including SOX or equivalent, PCI-DSS, GDPR, UK GDPR, data privacy regulations, and other applicable corporate and retail compliance obligations.

Education & Professional Background

• Bachelor’s degree in Information Security, Computer Science, Engineering, or a related field; advanced degree (e.g., MS in Cybersecurity) preferred.
• 15+ years of experience in Information Security, with at least 7 years in a senior or executive leadership role overseeing enterprise-scale security programs.
• Proven success leading global cybersecurity initiatives across multi-national or multi-brand organizations.
• Strong knowledge of regulatory requirements across U.S. and European jurisdictions, including GDPR, CCPA, and other privacy/security regulations.
• Demonstrated ability to balance security risk management with business enablement, ensuring security strategies are aligned with business objectives.
• Experience in incident response, crisis management, and executive-level communications during security incidents.
• Leadership & Influence Recognized as a strategic cybersecurity leader who can inspire trust and confidence at board, executive, and operational levels.
• Strong executive presence, with the ability to communicate complex technical concepts in clear, business-relevant terms.
• Proven capability to build, mentor, and lead high-performing security teams and encourage collaboration across geographies and business functions.

Benefits

• For those scheduled to work less than 20 hours per week: Employee Discount, EAP and Sick Pay.
• For those scheduled to work between 20 and 29.99 hours per week: Employee Discount, EAP, Sick Pay and Paid Time Off including paid Maternity and Parental Leave, Company Paid Holidays, Transit and 401(k) with Company Match.
• For those scheduled to work 30 hours or more: Employee Discount, EAP, Sick Pay and Paid Time Off including paid Maternity and Parental Leave, Company Paid Holidays, 401(k) with Company Match, Comprehensive Health Benefits (Medical, Dental and Vision), Healthcare and Dependent Care Spending Accounts, Healthcare Spending Account, Disability Benefits, Life Insurance, Transit, and Tuition Reimbursement.

Pay

An employee in this position can expect an annual starting rate between $350,000 - $400,000 depending on experience, seniority, geographic locations, and other factors permitted by law.

Schedule

N/A