Lead Information Security Analyst, ITC

Become a Part of the NIKE, Inc. Team

NIKE, Inc. does more than outfit the world's best athletes. It is a place to explore potential, obliterate boundaries and push out the edges of what can be. The company looks for people who can grow, think, dream and create. Its culture thrives by embracing diversity and rewarding imagination. The brand seeks achievers, leaders and visionaries. At NIKE, Inc. it's about each person bringing skills and passion to a challenging and constantly evolving game.

WHO YOU'LL WORK WITH

The Lead GRC Information Security Analyst 4 is an advanced individual contributor and workstream owner on the GRC team at Nike's India Technology Center (ITC), reporting to the ITC GRC Director. This role partners with the Global GRC team in Beaverton, Oregon and cross-functional leaders across Global Technology, Internal Audit, and Finance.

WHO WE ARE LOOKING FOR

The candidate needs to have advanced GRC delivery experience and the versatility to operate as a Lead GRC Athlete-running workstreams end-to-end across Governance, Risk, Compliance, and Technical Recovery, and rotating between them without re-hiring. This is a workstream ownership role that requires in-depth knowledge, conceptual thinking, and the credibility to work with Principals globally. The candidate provides direction and mentorship to Seniors and Analysts, advises the team on complex matters, and foresees most future implications of the solutions they implement. Solid working knowledge of SOX ITGC, NIST CSF and ISO 27001, risk lifecycle management, third-party cyber risk, DR/BCP practices, and ServiceNow GRC is essential. The candidate closes loops with artifacts and evidence and knows when to execute, when to govern, and when to escalate.

• 7+ years of professional experience in technology risk, cybersecurity risk, IT audit, compliance, or GRC in matrixed, multinational technology organizations
• Bachelor's degree or equivalent combination of education, experience, or training
• Professional certifications strongly preferred (e.g., CISA, CRISC, CISM, CISSP, GRCP, ISO 27001 LA/LI)
• Hands-on experience with ServiceNow GRC (or comparable platform)
• Demonstrated hands-on delivery across at least two of four GRC streams (Governance, Risk, Compliance, Technical Recovery)

• You own one or more workstreams end-to-end in the stream where demand is highest (Governance, Risk, Compliance, or Technical Recovery), rotating based on the stream with the longest queue
• You drive risk lifecycle discipline and risk register hygiene in ServiceNow GRC, and support policies, standards, exceptions, attestations, and governance forum cadence
• You drive SOX ITGC testing readiness and evidence quality, TPRM remediation, cybersecurity risk assessments, and DR/BCP exercise support
• You provide direction and mentorship to Senior and Analyst GRC Athletes on the workstream-unblocking issues, reviewing artifacts, and enforcing a quality bar
• You produce and interpret workstream metrics (control effectiveness, risk closure, TPRM cycle time, DR test outcomes) for Directors and Principals and recommend improvements
• You build strong working relationships with control owners, engineers, vendors, and cross-functional partners; you navigate ambiguity and competing priorities
• You identify recurring pain points, propose changes, and implement improvements with an eye to future implications for the global program