Senior Information Security Engineer, ITC

The Senior Security Automation Engineer focuses on the automation and integration of security tools to drive accountability and visibility of Nike's high-risk findings. The role works with multiple data sources and enterprise data for contextual enrichment, actionable output, and automated vulnerability management lifecycle. The position partners closely with Cyber Defence, Enterprise Cyber Security Consulting, Data Protection, Windows Client/Server Platform, and Cloud Security/Automation teams to assess, analyse, and optimise operational tasks, functions, documentation, and processes.

• Work with multiple data sources, including all data and other enterprise data, for contextual enrichment to drive actionable output and automated vulnerability management lifecycle.
• Partner with technical and business teams to understand customer use cases for remediation of vulnerabilities and risks, and provide solutions for self-service visibility into security findings for mitigation and automated reporting.
• Improve Nike's security posture by advocating for security best practices and implementation.
• Develop automation and complex orchestration to scale out vulnerability or risk data and correlated enrichment data across the organisation.
• Assist in developing automated solutions using scripting languages such as Python, Ansible, Perl, and PowerShell, and maintain pipeline integration of security tools into various development SDLCs.
• Educate engineers, developers, and product teams on the importance of vulnerability management and risks, effective tool use, and automated remediation of findings.
• Continually evaluate the current state of the programme and work with the team to find ways to automate and develop a future roadmap.
• Communicate complex technical issues simply to different audiences.
• Work on Azure, AWS, GCP, and AliCloud cloud platforms to automate security challenges.
• Partner closely with Cyber Defence, Enterprise Cyber Security Consulting, Data Protection, Windows Client/Server Platform, and Cloud Security/Automation teams to assess, analyse, and optimise operational tasks, functions, documentation, and processes.

• Minimum 5+ years of relevant experience.
• Expertise in interpreted languages, with Python as a must, and high-level languages such as JavaScript,.NET, and PowerShell, with full-stack development experience.
• Hands-on experience with ETL tools (e.g. GitHub, Apache NiFi, MS-SSIS, Jasper) and concepts.
• Software development background and strong knowledge of software development lifecycles.
• Previous experience deploying and maintaining configuration as code systems, services, containers, and applications in AWS, Azure, and/or GCP.
• Ability to develop and communicate recommendations to management.
• Ability to translate technical security vulnerabilities into business risk through automation.
• Strong problem-solving and conceptual thinking abilities.
• Strong ability to reverse engineer tools, exploits, and open-source applications, and ability to develop them.
• Experience looking for application security vulnerabilities such as Cross Site Scripting, SQL Injection, Cookie Manipulation, Buffer Overflows, etc.
• Familiarity with Windows and Unix operating systems.
• Ability to quickly learn new Information Security concepts and adapt to a fast-paced, ever-changing organisation.

• Bachelor's or Master's degree in computer science or information assurance.
• Experience with cloud automation.