Principal Cyber Defense Analyst, ITC

Job description

Become a Part of the NIKE, Inc. Team NIKE, Inc. does more than outfit the world’s best athletes. It is a place to explore potential, obliterate boundaries and push out the edges of what can be. The company looks for people who can grow, think, dream and create. Its culture thrives by embracing diversity and rewarding imagination. The brand seeks achievers, leaders and visionaries. At NIKE, Inc. it’s about each person bringing skills and passion to a challenging and constantly evolving game. WHO YOU’LL WORK WITH This role is part of the Cyber Threat Intelligence team within Corporate Information Security (CIS). You will work with teams within CIS, including the Nike Cyber Defense Center & Incident Response (NCDC/IR) and CIS Operations Management team. WHO WE ARE LOOKING FOR We’re looking for a Principal Threat Intelligence Analyst. This role is responsible for researching and analyzing current and emerging threats and vulnerabilities that have the potential to present risk to Nike. Our ideal candidate is highly experienced in the cyber threat intelligence field, believes in a business risk balanced approach, and excels in a highly-matrixed, people-focused environment. • Professional Experience: 8-10+ years of dedicated experience in cyber threat intelligence, security operations, or incident response, with a proven track record in an enterprise or global environment. • Threat Analysis & Frameworks: Deep, expert-level knowledge of cyber threat intelligence (CTI) principles, methodologies, and the intelligence lifecycle. Highly proficient in industry-standard frameworks and collaboration platforms, including MITRE ATT&CK, CAPEC, MISP, Malpedia, and STIX/TAXII. • Intelligence Requirements Ownership: Establish and own Priority and Strategic Intelligence Requirements (PIRs/SIRs) with executives and security leaders so intelligence production is decision-oriented, not vanity reporting. Own the threat-prioritization framework that maps threats to Nike’s crown jewels. • Collection Strategy: Define collection strategy and manage the source portfolio across open, closed, and technical sources, assessing coverage, gaps, and source reliability. • Analytic Rigor Standard: Set and enforce analytic tradecraft standards across CTI, the SOC, and Detection Engineering: Structured Analytic Techniques, source evaluation, explicit confidence statements, and traceable key judgments. Raise the analytic bar for the discipline. • Strategic Intelligence & Executive Influence: Produce strategic intelligence and board-ready risk framing, translating adversary activity into decision-ready guidance for executive leadership. Influence without authority and represent Nike in trust communities, ISACs, and external briefings. • Adversary Tracking & Attribution: Own tracking and attribution of threat actor groups and campaigns targeting Nike and the retail and consumer sector; cluster related activity and maintain the adversary knowledge base. • Intelligence-to-Detection Leadership: Drive the intelligence-to-detection pipeline. Set detection requirements from intelligence and measure how much CTI output becomes deployed detection coverage (e.g., Sigma, detection-as-code). • Measuring Intelligence Value: Define and report on intelligence effectiveness, including actionable-intelligence rate, detection-adoption rate, decisions influenced, and stakeholder satisfaction. • Technical & Automation Skills: Strong working-level knowledge of programming and scripting languages (Python, C, C++, Assembly) with the ability to leverage automation to build, refine, and scale detection capabilities. Comfortable creating and deploying complex YARA rules for proactive threat hunting. • Vulnerability & Exploit Analysis: Proven experience in threat validation, sandboxing, reverse engineering, and analyzing/validating the feasibility of exploits. Ability to assess exploit impact, development difficulty, and prioritize patching timelines based on proof-of-concepts (PoCs) and the enterprise threat landscape. Prioritize using modern vulnerability-intelligence signals such as the CISA KEV catalog, EPSS, and exploit-maturity indicators. • Incident Response Integration: First-hand experience working directly within incident response functions, providing actionable intelligence to support security operations centers (SOC) and incident response teams during active campaigns. • Community & Information Sharing: Active connections within the global cybersecurity and threat intelligence community. Experienced in identifying, developing, and maintaining access to non-standard intelligence sources. • Active Deception & Defense: Expertise in deploying and managing honeypots/honeynets, canaries, and other active deception tools to identify and analyze network attacks. • Leadership & Collaboration: Strong people leader with a demonstrated ability to build, motivate, and mentor diverse teams. Committed to sharing knowledge, helping team members grow their technical skillsets, and partnering with cross-functional CIS teams to refine processes. • Communication & Business Alignment: Excellent written and verbal communication skills, with a proven ability to translate complex technical threat details into clear, actionable, and business-relevant insights for stakeholders and executive leadership. • Ethics & Integrity: Unquestionable ethics and a proven ability to manage highly sensitive, classified, or proprietary material with the utmost discretion. • Adaptability & Resilience: Thrives in a highly-matrixed, fast-paced environment. View change as an opportunity and navigate ambiguity with confide