Principal Cyber Defense Analyst, ITC

Sits within the Cyber Threat Intelligence team in Corporate Information Security (CIS) and works with teams across CIS, including the Nike Cyber Defence Centre & Incident Response (NCDC/IR) and CIS Operations Management. It is responsible for researching and analysing current and emerging threats and vulnerabilities that may present risk to Nike. The role also works with the Lead Cyber Threat Intelligence team to perform intelligence tasks and support defensive operations.

• Maintain awareness of the cyber threat landscape and how it may impact Nike.
• Analyse Nike's possible exposure to vulnerabilities and validate the weaponisation of exploits.
• Recommend patching priorities and other changes to Nike's defensive posture based on the threat landscape.
• Research, write, and publish intelligence products for a variety of technical and non-technical audiences up to the executive level.
• Provide direct support to the Nike Cyber Defence Centre & Incident Response (NCDC/IR) by analysing possible malicious artefacts, providing in-depth research and analytical context, and recommending appropriate defensive security actions.
• Integrate a broad range of open- and closed-source intelligence tools, open-source research, and other data to collect against Nike's intelligence priorities.
• Develop API customisations for vendor tools that feed data visualisation tools, such as Tableau.
• Identify and develop IOCs through research, analysis, and pivoting.
• Share knowledge with the rest of the team and help other team members grow their skillsets.

• 8-10+ years of dedicated experience in cyber threat intelligence, security operations, or incident response, with a proven track record in an enterprise or global environment.
• Deep, expert-level knowledge of cyber threat intelligence (CTI) principles, methodologies, and the intelligence lifecycle.
• High proficiency in industry-standard frameworks and collaboration platforms, including MITRE ATT&CK, CAPEC, MISP, Malpedia, and STIX/TAXII.
• Experience establishing and owning Priority and Strategic Intelligence Requirements (PIRs/SIRs) with executives and security leaders so that intelligence production is decision-oriented.
• Experience owning a threat-prioritisation framework that maps threats to Nike's crown jewels.
• Experience defining collection strategy and managing a source portfolio across open, closed, and technical sources, including assessing coverage, gaps, and source reliability.
• Ability to set and enforce analytic tradecraft standards across CTI, the SOC, and Detection Engineering, including Structured Analytic Techniques, source evaluation, explicit confidence statements, and traceable key judgments.
• Experience producing strategic intelligence and board-ready risk framing, translating adversary activity into decision-ready guidance for executive leadership.
• Ability to influence without authority and represent Nike in trust communities, ISACs, and external briefings.
• Experience owning tracking and attribution of threat actor groups and campaigns targeting Nike and the retail and consumer sector, clustering related activity, and maintaining an adversary knowledge base.
• Experience driving the intelligence-to-detection pipeline, setting detection requirements from intelligence, and measuring how much CTI output becomes deployed detection coverage (e.g., Sigma, detection-as-code).
• Experience defining and reporting on intelligence effectiveness, including actionable-intelligence rate, detection-adoption rate, decisions influenced, and stakeholder satisfaction.
• Strong working-level knowledge of programming and scripting languages (Python, C, C++, Assembly) and the ability to leverage automation to build, refine, and scale detection capabilities.
• Comfort creating and deploying complex YARA rules for proactive threat hunting.
• Proven experience in threat validation, sandboxing, reverse engineering, and analysing or validating the feasibility of exploits.

• Industry-standard professional certifications such as GIAC Cyber Threat Intelligence (GCTI), GIAC Reverse Engineering Malware (GREM), or GIAC Exploit Researcher and Advanced Penetration Tester (GXPN).
• Certified Threat Intelligence Analyst (CTIA), CISSP, or equivalent advanced technical credentials.
• Familiarity with design-side threat modelling methodologies such as STRIDE or PASTA for partnering with product security.