Similar to other reviews on this site, Nike’s cybersecurity program is an unfortunate train wreck and it is best to avoid it. The CIS leadership had a multi-year plan to mature the security program and they squandered it through a combination of mismanagement and old fashioned incompetence, where form is more important than function.
For example, most companies build out processes for how technology will be used, but in CIS it is opposite - technology is purchased without a viable plan for how it will be used. CIS leadership squandered an amazing opportunity to build a top-notch cybersecurity program through bad management hires, political infighting, and a complete lack of any actionable plan to mature the program (beyond a shopping list of technologies they wanted to buy). Instead of maturing the existing processes and getting the new technology working, more tools were purchased... this added to frustrated engineers and analysts, since the CIS leadership focused on checking off boxes on their shopping list of new technologies and not on how the technology was actually being used. This was not always the case, but more often than not the rollouts did not focus on operationalizing the tools beyond go live. This is simply due to poor management and a lack of accountability for making bad operational decisions. It should be no surprise that this is what happens when you hire non-technical people into technology leadership roles.
Most disheartening was seeing how the NIKE Maxims were quoted repeatedly as guiding principles within CIS. However, in reality, the CIS leadership team ran in complete opposition – everything was lip service to doing the right thing. On the corporate side, everyone is expected to welcome new or challenging ideas, quickly evolving to new realities, and treat people with respect. Within CIS, the focus is to maintain the status quo and not to rock the boat. If you step out of line, you are listed as a trouble maker by the CIS leadership team.
Such a waste. Only take a job there if you want to drink the Kool-Aid and wish to remain blissfully ignorant to following sound security practices.
