Principal Information Security Analyst – Information Risk Management
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content. We have info: remote work except certain states, salary range, benefits link, description of role, responsibilities, qualifications, etc. No explicit Benefits details beyond link; we should not create Benefits section unless actual benefits described. The posting says "Information About Benefits Can Be Found Here." That's not specific benefit details, so we should not create Benefits section. Pay: we have salary range, so we can include Pay section. Schedule: not mentioned, so omit. About the role: we have description "WHO WE ARE LOOKING FOR" etc. Could be About the role. Responsibilities: we have many bullet points under "Key Responsibilities Include" etc. Requirements/Qualifications: we have "What You Bring" with degree, years experience. Skills: maybe we can extract skills like communication, analytical, etc. Could combine Requirements and Skills? But we need separate headings if content exists. We'll create sections: About the role, Responsibilities, Qualifications, Skills, Pay. Ensure we use for each. Use - for lists. Use
for prose.
We must not repeat job title. No metadata like Job ID. Remove boilerplate.
We need to preserve all substantive info. Let's extract.
About the role: paragraph summarizing role: "We're looking for a Principal Information Security Analyst to join the Information Risk Management (IRM) team within Corporate Information Security (CIS). This role is a senior individual contributor and program leader who will deliver against an information security and cybersecurity assessment plan integrated into a broader enterprise risk management program supported by executive management. You will leverage deep expertise in security policies, standards, controls, and industry best practices to perform and lead risk assessments of Nike systems and systems managed for Nike by vendors. You will also drive strategic advancement of Nike's Third-Party Risk Management (TPRM) program—establishing risk-profiling methodologies, tiered assurance frameworks, vendor lifecycle controls, and executive reporting capabilities that protect Nike's most sensitive data across a complex global vendor ecosystem. Our ideal candidate is a trusted advisor with superb communication skills, exceptional analytical and problem-solving ability, intellectual curiosity, and proven experience translating complex security risks for both technical and non-technical audiences—including executive leadership, procurement, legal, privacy, and technology partners. You thrive in cross-functional environments, influence without authority, and bring a principal-level perspective to program design, not just execution. Beyond assessment execution and program delivery, this role carries a broader organizational mandate. You will serve as a recognized subject matter expert in information risk and cybersecurity not only within CIS, but across Nike. Partner teams including Procurement, Legal, Privacy, Engineering, and the broader Nike Business will look to you as a trusted, accessible authority on information risk. You will also identify, initiate, and lead cross-functional programs that extend beyond IRM’s immediate scope, efforts such as enterprise-wide data governance alignment or cross-team risk standardization, bringing structure and momentum to problems that span organizational boundaries."
That's a lot; we can keep as About the role.
Responsibilities: list items from "Key Responsibilities Include" and sub-bullets. We'll need to capture each bullet as
- . The text includes many sentences; we can break into logical items.
Let's list:
- Advance TPRM capability maturity by designing and implementing program rigor beyond control self-assessments, including vendor risk profiling, risk-based controls testing, and tiered assurance requirements
- Establish and operationalize a standardized vendor risk-profiling methodology (e.g., data sensitivity, criticality, regulatory impact) to consistently categorize vendors by inherent risk tier and drive risk-based assessment prioritization
- Define and implement tiered assurance requirements so that higher-risk vendors undergo deeper validation (evidence reviews, control testing, security baseline documentation) while lower-risk vendors follow appropriately scaled processes
- Introduce targeted validation of high-impact controls (e.g., access management, data protection, availability) for critical suppliers, going beyond self-attestation to validate design and operational effectiveness
- Establish mandatory control effectiveness standards requiring vendors to demonstrate effective design and operational execution for high-impact controls prior to contractual engagement or network integration
- Develop and operationalize TPRM metrics and executive reporting, including third-party blind metrics and integration into Executive TPRM Council reporting
- Expand factory risk assessment program scope and contribute to assurance activities for Nike's highest-risk indirect and direct third parties
- Plan and execute joint response planning tabletop exercises with key direct and indirect suppliers to validate incident readiness and coordination capabilities
- Close vendor onboarding gaps by designing and enforcing standardized, enterprise-wide onboarding controls to ensure no vendor obtains network access or data-sharing capability until a thorough risk assessment is completed
- Build and steward a centralized vendor inventory capturing all active vendors, associated services, and data-sharing agreements, with inventory updates embedded into the global onboarding workflow
- Design and enforce a standardized, enterprise-wide vendor offboarding process to ensure all vendor access and data-sharing channels are terminated promptly and consistently at contract end
- Partner with Procurement, Legal, Privacy, and Technology to align vendor lifecycle controls across domains and drive measurable compliance with TPRM onboarding and offboarding requirements
- Serve as a recognized subject matter expert in information risk and cybersecurity across Nike, representing IRM and CIS with credibility and authority in forums, partner team engagements, and ad-hoc consultations
- Embed with cross-functional partners, including Procurement, Legal, Privacy, Engineering, and Nike Business teams, to provide ongoing security risk guidance, ensuring these teams view information security as a strategic partner invested in their success
- Identify emerging risks, capability gaps, and opportunities for enterprise-wide improvement that others have not yet surfaced, and drive action by building the case, gaining stakeholder alignment, and advancing solutions
- Initiate and lead cross-team programs and initiatives that extend beyond IRM, such as enterprise data governance alignment, cross-domain risk standardization, or shared assurance frameworks, taking them from concept through operationalization with minimal oversight
- When assigned to lead or support broader organizational initiatives, operate with full autonomy: set direction, engage stakeholders, build roadmaps, and drive execution end-to-end
- Maintain and elevate the reputation of IRM and CIS by consistently demonstrating deep understanding of business context, delivering pragmatic risk guidance, and building trust as someone who gives direct, honest assessments of risk
- Perform and lead formal risk assessments on partner and vendor connections, evaluating vendor processes at the point of engagement with Nike
- Ensure sufficient validation of data sharing arrangements and agreements to protect Nike's sensitive information
- Confirm business objectives align with the type and volume of data used, maintaining a "need to know/use" mindset
- Review third-party SOC reports, security baseline documentation, and vendor security evidence as part of assessment activities
- Establish risk and remediation ownership for identified vendor-related risks and document findings in the Risk Register
- Serve as a senior escalation point for complex vendor risk decisions and exception recommendations
- Lead assessments of complex platforms and systems against Nike security and configuration standards
- Evaluate and process exceptions to information security policies and standards, providing principal-level recommendations on risk acceptance and compensating controls
- Perform compliance control validation testing to determine the operating effectiveness of IT controls for scoped systems
- Consult with technology units on IT general controls (ITGCs) and compliance matters
- Champion information security policies, standards, controls, and processes so compliance requirements are addressed as part of business-as-usual operations
- Identify, document, and elevate visibility to information risk where business direction creates potential exposure to employee, athlete, and product sensitive data streams
- Identify and profile Nike systems and processes that require risk assessments; scope and lead specific assessments accordingly
- Perform detailed analysis of threats and vulnerabilities across information security domains including network security, asset security, security engineering, identity and access management, security operations, and software development security
- Review key system configurations and complex IT infrastructures (e.g., cloud services, SaaS platforms, hybrid environments)
- Communicate effectively through risk reports, presentations, and stakeholder interactions to drive remediation of identified risks
- Own vendor risk management metrics, reporting, and master data stewardship to improve accuracy, timeliness, and completeness
- Provide analysis and insights into data supporting the effectiveness of technical and process-based cybersecurity controls
- Lead process improvements for data retrieval, analysis, and risk assessment intake
- Contribute to and lead IRM team projects and strategic initiatives, including documentation in ServiceNow (SNOW), Aravo, Jira, and Box
- Support the risk analysis intake process and participate in daily standups and weekly process meetings
- Mentor and coach Senior and Analyst-level team members on assessment methodology, stakeholder engagement, and risk communication
- Influence information security strategy through risk-informed insights and expertise that drive the strategic direction of CIS in alignment with Nike's overall strategic vision
- Execute and lead targeted internal and external (vendor) risk assessments in support of IRM strategy, following established team processes and enablers while continuously improving them
- Be proactive in anticipating next steps in the risk assessment process and act accordingly
- Collaborate with team members on assessment approach, scoping, documentation, and issue presentation activities; provide quality review and guidance on team deliverables
- Serve as a principal-level information security and CIS representative to Nike lines of business and management, acting as the team’s voice in cross-functional forums, building enduring relationships with partner teams, and ensuring IRM is sought out as a trusted advisor rather than engaged only as a checkpoint
- Provide enforcement of security policies, standards, and procedures by working cross-functionally with Compliance and Governance functions
- Stay current on information security technologies, trends, standards, best practices, and emerging threats and vulnerabilities
That's a lot but we must preserve all substantive info. It's okay to have a long list.
Qualifications: from "What You Bring": Bachelor's degree in Business Information Management, Computer Science, or a related field; will accept any suitable combination of education, experience, and training; 8+ years of experience in information security, risk management, GRC, third-party risk management, or a related field, with demonstrated progression in scope, complexity, and influence; 3+ years of experience performing vendor/third-party risk assessments and leading inter (cut off). The text cut off at "leading inter". Probably "leading inter..." maybe "leading interdisciplinary teams"? But we have incomplete. We should preserve as given: "3+ years of experience performing vendor/third-party risk assessments and leading inter". We'll keep that exactly.
Skills: we can extract communication, analytical, problem-solving, intellectual curiosity, translating complex security risks, influencing without authority, etc. Could list.
Pay: we have salary range: $149,100.00 to $313,900.00, varies based on location, qualifications, skills, experience.
We also have remote work info: "Open to remote work except in South Dakota, Vermont and West Virginia." That's not a section but could be included in About the role or maybe as a note. We'll incorporate into About the role paragraph.
We must not include Benefits section.
Now produce HTML.
Structure:
About the role
Open to remote work except in South Dakota, Vermont and West Virginia. The annual base salary for this position ranges from $149,100.00 in our lowest geographic market to $313,900.00 in our highest geographic market. Actual salary will vary based on a candidate's location, qualifications, skills and experience. Information About Benefits Can Be Found Here. We're looking for a Principal Information Security Analyst to join the Information Risk Management (IRM) team within Corporate Information Security (CIS). ...
But we already have Pay section separate; we might not repeat salary in About the role. Better to keep About the role without salary; Pay section separate. However the instruction: include a section ONLY when posting has real specific content. About the role we have content. Pay we have content. So we can keep About the role without salary; but we might still mention remote work eligibility. That's fine.
Thus About the role paragraph: "Open to remote work except in South Dakota, Vermont and West Virginia
- for lists. Use
for prose. We must not repeat job title. No metadata like Job ID. Remove boilerplate. We need to preserve all substantive info. Let's extract. About the role: paragraph summarizing role: "We're looking for a Principal Information Security Analyst to join the Information Risk Management (IRM) team within Corporate Information Security (CIS). This role is a senior individual contributor and program leader who will deliver against an information security and cybersecurity assessment plan integrated into a broader enterprise risk management program supported by executive management. You will leverage deep expertise in security policies, standards, controls, and industry best practices to perform and lead risk assessments of Nike systems and systems managed for Nike by vendors. You will also drive strategic advancement of Nike's Third-Party Risk Management (TPRM) program—establishing risk-profiling methodologies, tiered assurance frameworks, vendor lifecycle controls, and executive reporting capabilities that protect Nike's most sensitive data across a complex global vendor ecosystem. Our ideal candidate is a trusted advisor with superb communication skills, exceptional analytical and problem-solving ability, intellectual curiosity, and proven experience translating complex security risks for both technical and non-technical audiences—including executive leadership, procurement, legal, privacy, and technology partners. You thrive in cross-functional environments, influence without authority, and bring a principal-level perspective to program design, not just execution. Beyond assessment execution and program delivery, this role carries a broader organizational mandate. You will serve as a recognized subject matter expert in information risk and cybersecurity not only within CIS, but across Nike. Partner teams including Procurement, Legal, Privacy, Engineering, and the broader Nike Business will look to you as a trusted, accessible authority on information risk. You will also identify, initiate, and lead cross-functional programs that extend beyond IRM’s immediate scope, efforts such as enterprise-wide data governance alignment or cross-team risk standardization, bringing structure and momentum to problems that span organizational boundaries." That's a lot; we can keep as About the role. Responsibilities: list items from "Key Responsibilities Include" and sub-bullets. We'll need to capture each bullet as
- . The text includes many sentences; we can break into logical items.
Let's list:
- Advance TPRM capability maturity by designing and implementing program rigor beyond control self-assessments, including vendor risk profiling, risk-based controls testing, and tiered assurance requirements
- Establish and operationalize a standardized vendor risk-profiling methodology (e.g., data sensitivity, criticality, regulatory impact) to consistently categorize vendors by inherent risk tier and drive risk-based assessment prioritization
- Define and implement tiered assurance requirements so that higher-risk vendors undergo deeper validation (evidence reviews, control testing, security baseline documentation) while lower-risk vendors follow appropriately scaled processes
- Introduce targeted validation of high-impact controls (e.g., access management, data protection, availability) for critical suppliers, going beyond self-attestation to validate design and operational effectiveness
- Establish mandatory control effectiveness standards requiring vendors to demonstrate effective design and operational execution for high-impact controls prior to contractual engagement or network integration
- Develop and operationalize TPRM metrics and executive reporting, including third-party blind metrics and integration into Executive TPRM Council reporting
- Expand factory risk assessment program scope and contribute to assurance activities for Nike's highest-risk indirect and direct third parties
- Plan and execute joint response planning tabletop exercises with key direct and indirect suppliers to validate incident readiness and coordination capabilities
- Close vendor onboarding gaps by designing and enforcing standardized, enterprise-wide onboarding controls to ensure no vendor obtains network access or data-sharing capability until a thorough risk assessment is completed
- Build and steward a centralized vendor inventory capturing all active vendors, associated services, and data-sharing agreements, with inventory updates embedded into the global onboarding workflow
- Design and enforce a standardized, enterprise-wide vendor offboarding process to ensure all vendor access and data-sharing channels are terminated promptly and consistently at contract end
- Partner with Procurement, Legal, Privacy, and Technology to align vendor lifecycle controls across domains and drive measurable compliance with TPRM onboarding and offboarding requirements
- Serve as a recognized subject matter expert in information risk and cybersecurity across Nike, representing IRM and CIS with credibility and authority in forums, partner team engagements, and ad-hoc consultations
- Embed with cross-functional partners, including Procurement, Legal, Privacy, Engineering, and Nike Business teams, to provide ongoing security risk guidance, ensuring these teams view information security as a strategic partner invested in their success
- Identify emerging risks, capability gaps, and opportunities for enterprise-wide improvement that others have not yet surfaced, and drive action by building the case, gaining stakeholder alignment, and advancing solutions
- Initiate and lead cross-team programs and initiatives that extend beyond IRM, such as enterprise data governance alignment, cross-domain risk standardization, or shared assurance frameworks, taking them from concept through operationalization with minimal oversight
- When assigned to lead or support broader organizational initiatives, operate with full autonomy: set direction, engage stakeholders, build roadmaps, and drive execution end-to-end
- Maintain and elevate the reputation of IRM and CIS by consistently demonstrating deep understanding of business context, delivering pragmatic risk guidance, and building trust as someone who gives direct, honest assessments of risk
- Perform and lead formal risk assessments on partner and vendor connections, evaluating vendor processes at the point of engagement with Nike
- Ensure sufficient validation of data sharing arrangements and agreements to protect Nike's sensitive information
- Confirm business objectives align with the type and volume of data used, maintaining a "need to know/use" mindset
- Review third-party SOC reports, security baseline documentation, and vendor security evidence as part of assessment activities
- Establish risk and remediation ownership for identified vendor-related risks and document findings in the Risk Register
- Serve as a senior escalation point for complex vendor risk decisions and exception recommendations
- Lead assessments of complex platforms and systems against Nike security and configuration standards
- Evaluate and process exceptions to information security policies and standards, providing principal-level recommendations on risk acceptance and compensating controls
- Perform compliance control validation testing to determine the operating effectiveness of IT controls for scoped systems
- Consult with technology units on IT general controls (ITGCs) and compliance matters
- Champion information security policies, standards, controls, and processes so compliance requirements are addressed as part of business-as-usual operations
- Identify, document, and elevate visibility to information risk where business direction creates potential exposure to employee, athlete, and product sensitive data streams
- Identify and profile Nike systems and processes that require risk assessments; scope and lead specific assessments accordingly
- Perform detailed analysis of threats and vulnerabilities across information security domains including network security, asset security, security engineering, identity and access management, security operations, and software development security
- Review key system configurations and complex IT infrastructures (e.g., cloud services, SaaS platforms, hybrid environments)
- Communicate effectively through risk reports, presentations, and stakeholder interactions to drive remediation of identified risks
- Own vendor risk management metrics, reporting, and master data stewardship to improve accuracy, timeliness, and completeness
- Provide analysis and insights into data supporting the effectiveness of technical and process-based cybersecurity controls
- Lead process improvements for data retrieval, analysis, and risk assessment intake
- Contribute to and lead IRM team projects and strategic initiatives, including documentation in ServiceNow (SNOW), Aravo, Jira, and Box
- Support the risk analysis intake process and participate in daily standups and weekly process meetings
- Mentor and coach Senior and Analyst-level team members on assessment methodology, stakeholder engagement, and risk communication
- Influence information security strategy through risk-informed insights and expertise that drive the strategic direction of CIS in alignment with Nike's overall strategic vision
- Execute and lead targeted internal and external (vendor) risk assessments in support of IRM strategy, following established team processes and enablers while continuously improving them
- Be proactive in anticipating next steps in the risk assessment process and act accordingly
- Collaborate with team members on assessment approach, scoping, documentation, and issue presentation activities; provide quality review and guidance on team deliverables
- Serve as a principal-level information security and CIS representative to Nike lines of business and management, acting as the team’s voice in cross-functional forums, building enduring relationships with partner teams, and ensuring IRM is sought out as a trusted advisor rather than engaged only as a checkpoint
- Provide enforcement of security policies, standards, and procedures by working cross-functionally with Compliance and Governance functions
- Stay current on information security technologies, trends, standards, best practices, and emerging threats and vulnerabilities
That's a lot but we must preserve all substantive info. It's okay to have a long list.
Qualifications: from "What You Bring": Bachelor's degree in Business Information Management, Computer Science, or a related field; will accept any suitable combination of education, experience, and training; 8+ years of experience in information security, risk management, GRC, third-party risk management, or a related field, with demonstrated progression in scope, complexity, and influence; 3+ years of experience performing vendor/third-party risk assessments and leading inter (cut off). The text cut off at "leading inter". Probably "leading inter..." maybe "leading interdisciplinary teams"? But we have incomplete. We should preserve as given: "3+ years of experience performing vendor/third-party risk assessments and leading inter". We'll keep that exactly.
Skills: we can extract communication, analytical, problem-solving, intellectual curiosity, translating complex security risks, influencing without authority, etc. Could list.
Pay: we have salary range: $149,100.00 to $313,900.00, varies based on location, qualifications, skills, experience.
We also have remote work info: "Open to remote work except in South Dakota, Vermont and West Virginia." That's not a section but could be included in About the role or maybe as a note. We'll incorporate into About the role paragraph.
We must not include Benefits section.
Now produce HTML.
Structure:
About the role
Open to remote work except in South Dakota, Vermont and West Virginia. The annual base salary for this position ranges from $149,100.00 in our lowest geographic market to $313,900.00 in our highest geographic market. Actual salary will vary based on a candidate's location, qualifications, skills and experience. Information About Benefits Can Be Found Here. We're looking for a Principal Information Security Analyst to join the Information Risk Management (IRM) team within Corporate Information Security (CIS). ...
But we already have Pay section separate; we might not repeat salary in About the role. Better to keep About the role without salary; Pay section separate. However the instruction: include a section ONLY when posting has real specific content. About the role we have content. Pay we have content. So we can keep About the role without salary; but we might still mention remote work eligibility. That's fine. Thus About the role paragraph: "Open to remote work except in South Dakota, Vermont and West Virginia