Become a Part of the NIKE, Inc. Team
NIKE, Inc. does more than outfit the world's best athletes. It is a place to explore potential, obliterate boundaries and push out the edges of what can be. The company looks for people who can grow, think, dream and create. Its culture thrives by embracing diversity and rewarding imagination. The brand seeks achievers, leaders and visionaries. At NIKE, Inc. it's about each person bringing skills and passion to a challenging and constantly evolving game.
WHO YOU'LL WORK WITHThis role is part of the Cyber Threat Intelligence team within Corporate Information Security (CIS). You will work with teams within CIS, including the Nike Cyber Defense Center & Incident Response (NCDC/IR) and CIS Operations Management team.
WHO WE ARE LOOKING FORWe're looking for a Principal Threat Intelligence Analyst. This role is responsible for researching and analyzing current and emerging threats and vulnerabilities that have the potential to present risk to Nike. Our ideal candidate is highly experienced in the cyber threat intelligence field, believes in a business risk balanced approach, and excels in a highly-matrixed, people-focused environment.
- Professional Experience: 8-10+ years of dedicated experience in cyber threat intelligence, security operations, or incident response, with a proven track record in an enterprise or global environment.
- Threat Analysis & Frameworks: Deep, expert-level knowledge of cyber threat intelligence (CTI) principles, methodologies, and the intelligence lifecycle. Highly proficient in industry-standard frameworks and collaboration platforms, including MITRE ATT&CK, CAPEC, MISP, Malpedia, and STIX/TAXII.
- Intelligence Requirements Ownership: Establish and own Priority and Strategic Intelligence Requirements (PIRs/SIRs) with executives and security leaders so intelligence production is decision-oriented, not vanity reporting. Own the threat-prioritization framework that maps threats to Nike's crown jewels.
- Collection Strategy: Define collection strategy and manage the source portfolio across open, closed, and technical sources, assessing coverage, gaps, and source reliability.
- Analytic Rigor Standard: Set and enforce analytic tradecraft standards across CTI, the SOC, and Detection Engineering: Structured Analytic Techniques, source evaluation, explicit confidence statements, and traceable key judgments. Raise the analytic bar for the discipline.
- Strategic Intelligence & Executive Influence: Produce strategic intelligence and board-ready risk framing, translating adversary activity into decision-ready guidance for executive leadership. Influence without authority and represent Nike in trust communities, ISACs, and external briefings.
- Adversary Tracking & Attribution: Own tracking and attribution of threat actor groups and campaigns targeting Nike and the retail and consumer sector; cluster related activity and maintain the adversary knowledge base.
- Intelligence-to-Detection Leadership: Drive the intelligence-to-detection pipeline. Set detection requirements from intelligence and measure how much CTI output becomes deployed detection coverage (e.g., Sigma, detection-as-code).
- Measuring Intelligence Value: Define and report on intelligence effectiveness, including actionable-intelligence rate, detection-adoption rate, decisions influenced, and stakeholder satisfaction.
- Technical & Automation Skills: Strong working-level knowledge of programming and scripting languages (Python, C, C++, Assembly) with the ability to leverage automation to build, refine, and scale detection capabilities. Comfortable creating and deploying complex YARA rules for proactive threat hunting.
- Vulnerability & Exploit Analysis: Proven experience in threat validation, sandboxing, reverse engineering, and analyzing/validating the feasibility of exploits. Ability to assess exploit impact, development difficulty, and prioritize patching timelines based on proof-of-concepts (PoCs) and the enterprise threat landscape. Prioritize using modern vulnerability-intelligence signals such as the CISA KEV catalog, EPSS, and exploit-maturity indicators.
- Incident Response Integration: First-hand experience working directly within incident response functions, providing actionable intelligence to support security operations centers (SOC) and incident response teams during active campaigns.
- Community & Information Sharing: Active connections within the global cybersecurity and threat intelligence community. Experienced in identifying, developing, and maintaining access to non-standard intelligence sources.
- Active Deception & Defense: Expertise in deploying and managing honeypots/honeynets, canaries, and other active deception tools to identify and analyze network attacks.
- Leadership & Collaboration: Strong people leader with a demonstrated ability to build, motivate, and mentor diverse teams. Committed to sharing knowledge, helping team members grow their technical skillsets, and partnering with cross-functional CIS teams to refine processes.
- Communication & Business Alignment: Excellent written and verbal communication skills, with a proven ability to translate complex technical threat details into clear, actionable, and business-relevant insights for stakeholders and executive leadership.
- Ethics & Integrity: Unquestionable ethics and a proven ability to manage highly sensitive, classified, or proprietary material with the utmost discretion.
- Adaptability & Resilience: Thrives in a highly-matrixed, fast-paced environment. View change as an opportunity and navigate ambiguity with confidence and composure.
- Commitment to Excellence: Values work-life balance while maintaining the flexibility and dedication required to collectively respond to critical, ad-hoc security incidents or emerging threats during off-hours when necessary.
- Education: Bachelor's degree in Information Technology, Information Security/Assurance, Computer Science, Engineering, or a related field of study (or equivalent professional experience).
- Threat Modeling: Extensive experience with adversary-focused threat modeling: MITRE ATT&CK-based threat profiling, adversary emulation, and attack-path modeling against high-value assets. (Familiarity with design-side methodologies such as STRIDE or PASTA is a plus for partnering with product security.)
- Certifications (Preferred): Industry-standard professional certifications such as GIAC Cyber Threat Intelligence (GCTI) and, given the reverse-engineering and exploit-analysis emphasis, GIAC Reverse Engineering Malware (GREM) or GIAC Exploit Researcher and Advanced Penetration Tester (GXPN). Certified Threat Intelligence Analyst (CTIA), CISSP, or equivalent advanced technical credentials also valued.
- Core Drive: Customer-oriented focus, self-driven, diligent, and passionate about protecting global brands and consumers.
WHAT YOU'LL WORK ONIf this is you, you'll be working with the Lead Cyber Threat Intelligence team and performing these key tasks:
- Maintain awareness of the cyber threat landscape and how it may impact Nike.
- Analyze Nike's possible exposure to vulnerabilities and validate the weaponization of exploits.
- Recommend patching priorities and other changes to Nike's defensive posture based on the threat landscape.
- Research, write, and publish intelligence products for a variety of technical and non-technical audiences up to the executive level. Candidates may be asked to provide a writing sample.
- Provide direct support to the Nike Cyber Defense Center & Incident Response (NCDC/IR), by analyzing possible malicious artifacts, providing in-depth research and analytical context, and recommending appropriate defensive security actions.
- Integrate a broad range of open- and closed-sources intelligence tools, open source research, and other data to collect against Nike's intelligence priorities.
- API customizations from vendor tools that feed data visualization tools, such as Tableau.
- Identify and develop IOCs through research, analysis, and pivoting.
- Share knowledge with the rest of the team and help other team members grow their skillsets.
