Principal Information Security Analyst, ITC

About the role

Nike is hiring a Principal GRC Information Security Analyst for its India Technology Center (ITC), Karnataka. As the top GRC individual contributor at ITC, the role reports to the ITC GRC Director, partners with the Global GRC team in Beaverton, Oregon, and works with leaders across Global Technology, Internal Audit, Legal and Finance. It is the senior anchor role at ITC, requiring a recognized subject-matter expert who leads the most complex problems, coaches the ITC GRC team and represents ITC in global forums.

Key responsibilities

• Lead the primary GRC stream at ITC (rotating across Governance, Risk, Compliance or Technical Recovery) and give senior technical coverage across the others, partnering with the Global GRC Principal on operating-model design.
• Translate global GRC standards, policies and platform designs into ITC-executable playbooks, workflows and control patterns, and recommend improvements back to Global GRC.
• Govern end-to-end risk lifecycle quality and the enterprise risk register for ITC-supported risks, including policies, standards, exceptions, attestations and governance forums.
• Provide senior direction on SOX ITGC, cybersecurity risk assessments, third-party cyber risk and DR/BCP resilience for global initiatives supported from ITC.
• Serve as the ITC power user and design partner for ServiceNow GRC, driving workflow improvements, control library hygiene, attestations, dashboards and adoption.
• Coach and mentor Leads, Seniors and Analysts, and represent ITC in global governance forums.

Required profile

• 10+ years of professional experience in technology risk, cybersecurity risk, IT audit, compliance or GRC in large, matrixed, multinational technology organizations.
• Bachelor's degree or equivalent combination of education, experience or training; advanced degree or professional certifications strongly preferred (e.g. CISSP, CISM, CRISC, CISA, GRCP, ISO 27001 LA/LI).
• Demonstrated hands-on delivery across at least two of the four GRC streams (Governance, Risk, Compliance, Technical Recovery).
• Comfortable with novel and ambiguous problems, developing concepts, playbooks and standards that scale globally, and influencing senior leaders without direct authority.

Required skills

• Strong command of SOX ITGC, cybersecurity regulations, NIST CSF and ISO 27001, third-party cyber risk, cybersecurity risk assessments, DR/BCP resilience and enterprise risk lifecycle discipline.
• Hands-on experience with ServiceNow GRC (or a comparable platform).