Lead Cyber Defense Data Analyst, ITC

WHO YOU’LL WORK WITH

This role reports into the Cyber Defense team at Nike within Corporate Information Security. You will work with Privacy, Legal, Incident Response, Nike Cyber Defense Center teams, and leaders and stakeholders across the business.

WHO WE ARE LOOKING FOR

We’re looking for a Lead Cyber Defense Incident Data Analyst in the Cyber Incident Response, Analysis and Management team. As the Incident Response team investigates the incident, Data Analysts jumps into action to understand the data impact. This role solves complex problems using highly technical solutions and playbooks, driving clarity through analysis and reporting.

The candidate needs to be a team player with strong analytics experience, curiosity, and communication skills. We are looking for an individual who is a problem solver, adept at making good decisions under pressure, comfortable with cross-functional and distributed teams, and flexible with changing priorities.

Bachelor’s degree in computer science or related field, or equivalent work experience

Five years of information technology experience with preferred three years in a cyber incident management or business continuity role

Knowledge of information security standards, principles, and practices

Strong project coordination skills including driving action across multiple stakeholders

Experience managing multiple complex workstreams simultaneously

Expertise in MS Excel or similar tools to analyze data and extract meaningful insights and trends

4+ years building production data pipelines, with substantial PySpark and Databricks experience (Unity Catalog, jobs, notebooks, volumes)

Strong Python engineering: modular libraries, pytest, clear abstractions, and comfort debugging distributed Spark jobs

Analytical and curious — you dig into unfamiliar data, form hypotheses, validate them, and explain what you learned

Comfortable working through ambiguity — incomplete specs, messy inputs, and evolving requirements do not paralyze you; you investigate, make reasoned decisions, and document uncertainty

Experience building outputs for non-technical audiences — dashboards, reports, or apps that business users can use without reading code

Experience with data quality, lineage, and auditability — grains, traceability keys, idempotent runs, and run logs

Comfort in time-bound, high-stakes environments where accuracy matters more than convenience

Experience with job orchestration (Databricks Jobs, CI/CD for data assets, failure triage and repair)

Daily fluency with AI coding tools such as Cursor or GitHub Copilot — you use them to move faster but review, test, and own the output

Proven track record of success in fast-moving organizations with complex technology applications

Passion for Nike, for security, and a drive for continuous learning

SIEM and SOAR experience a plus

Understanding of Legal Privacy concepts and regulations worldwide a plus

One or more of the following professional certifications a plus

Certified Information Security Professional (CISSP)

Certified Business Continuity Professional (CBCP)

Global Information Assurance Certifications (GIAC)

WHAT YOU’LL WORK ON

If this is you, you’ll be working with the CIDA team and performing these key tasks:

Build and maintain PySpark pipelines and shared Python libraries for extraction, validation, entity resolution, and analyst-facing views

Navigate ambiguous source data — investigate unfamiliar schemas, interpret unclear patterns, and make judgment calls when rules do not cover every case

Investigate source data analytically — discover patterns, explain anomalies, and extract insights beyond raw field extraction

Build visualizations, dashboards, and in-app methodology guides that make results understandable to non-technical users

Operate production jobs on Databricks: deploy, monitor, triage failures, and optimize for speed without sacrificing correctness

Enforce data quality, traceability, and auditability — hard QC gates, versioned logic, run logs, and documented waivers

Use AI coding tools (Cursor, GitHub Copilot) as part of your daily workflow while owning review, testing, and what ships