WHO YOU’LL WORK WITH
This role reports into the Cyber Defense team at Nike within Corporate Information Security. You will work with Privacy, Legal, Incident Response, Nike Cyber Defense Center teams, and leaders and stakeholders across the business.
WHO WE ARE LOOKING FOR
We’re looking for a Lead Cyber Defense Incident Data Analyst in the Cyber Incident Response, Analysis and Management team. As the Incident Response team investigates the incident, Data Analysts jumps into action to understand the data impact. This role solves complex problems using highly technical solutions and playbooks, driving clarity through analysis and reporting.
The candidate needs to be a team player with strong analytics experience, curiosity, and communication skills. We are looking for an individual who is a problem solver, adept at making good decisions under pressure, comfortable with cross-functional and distributed teams, and flexible with changing priorities.
- Bachelor’s degree in computer science or related field, or equivalent work experience
- Five years of information technology experience with preferred three years in a cyber incident management or business continuity role
- Knowledge of information security standards, principles, and practices
- Strong project coordination skills including driving action across multiple stakeholders
- Experience managing multiple complex workstreams simultaneously
- Expertise in MS Excel or similar tools to analyze data and extract meaningful insights and trends
- 4+ years building production data pipelines, with substantial PySpark and Databricks experience (Unity Catalog, jobs, notebooks, volumes)
- Strong Python engineering: modular libraries, pytest, clear abstractions, and comfort debugging distributed Spark jobs
- Analytical and curious — you dig into unfamiliar data, form hypotheses, validate them, and explain what you learned
- Comfortable working through ambiguity — incomplete specs, messy inputs, and evolving requirements do not paralyze you; you investigate, make reasoned decisions, and document uncertainty
- Experience building outputs for non-technical audiences — dashboards, reports, or apps that business users can use without reading code
- Experience with data quality, lineage, and auditability — grains, traceability keys, idempotent runs, and run logs
- Comfort in time-bound, high-stakes environments where accuracy matters more than convenience
- Experience with job orchestration (Databricks Jobs, CI/CD for data assets, failure triage and repair)
- Daily fluency with AI coding tools such as Cursor or GitHub Copilot — you use them to move faster but review, test, and own the output
- Proven track record of success in fast-moving organizations with complex technology applications
- Passion for Nike, for security, and a drive for continuous learning
- SIEM and SOAR experience a plus
- Understanding of Legal Privacy concepts and regulations worldwide a plus
- One or more of the following professional certifications a plus
- Certified Information Security Professional (CISSP)
- Certified Business Continuity Professional (CBCP)
- Global Information Assurance Certifications (GIAC)
WHAT YOU’LL WORK ON
If this is you, you’ll be working with the CIDA team and performing these key tasks:
- Build and maintain PySpark pipelines and shared Python libraries for extraction, validation, entity resolution, and analyst-facing views
- Navigate ambiguous source data — investigate unfamiliar schemas, interpret unclear patterns, and make judgment calls when rules do not cover every case
- Investigate source data analytically — discover patterns, explain anomalies, and extract insights beyond raw field extraction
- Build visualizations, dashboards, and in-app methodology guides that make results understandable to non-technical users
- Operate production jobs on Databricks: deploy, monitor, triage failures, and optimize for speed without sacrificing correctness
- Enforce data quality, traceability, and auditability — hard QC gates, versioned logic, run logs, and documented waivers
- Use AI coding tools (Cursor, GitHub Copilot) as part of your daily workflow while owning review, testing, and what ships