Cybersecurity Operations & Architecture

WORK OPTION: The NBA currently provides eligible employees the option of working remotely one day per week.

_________________

Position Summary

The National Basketball Association (NBA) is seeking a strategic, highly collaborative, and technically credible Vice President, Cybersecurity Operations & Architecture to lead the design, operation, and continuous improvement of cybersecurity capabilities across the organization’s global technology ecosystem. Reporting directly to the Chief Information Security Officer (CISO), this role serves as the senior leader accountable for integrating enterprise security architecture with day-to-day cyber defense, incident response, threat detection, and infrastructure protection.

The Vice President will establish security architecture strategy, standards, roadmaps, and reference architectures while ensuring those designs translate into sustainable operational controls, measurable detection coverage, effective response capabilities, and resilient technology services. The role will partner extensively with Cybersecurity, Enterprise Technology, Infrastructure, Engineering, Digital Products, Data & Analytics, Media Operations, Basketball Operations, Legal, Privacy, Compliance, NBA teams, arena operators, and external technology partners.

A core responsibility is setting NBA arena cybersecurity standards and making certain they are adhered to. This includes defining practical and enforceable requirements, guiding assessments and remediation, and addressing the security of arena IT, cloud-connected services, operational technology, building and display control systems, game and event technologies, broadcast dependencies, and third-party integrations.

Major Responsibilities

Cybersecurity Strategy, Leadership & Operating Model

• Develop and execute an integrated, multi-year cybersecurity operations and architecture strategy aligned with business priorities, technology roadmaps, risk tolerance, and the evolving threat landscape.
• Lead and mature the Cybersecurity Operations and Cybersecurity Architecture functions, establishing clear accountability, decision rights, service models, performance expectations, and escalation paths.
• Serve as a trusted advisor to the CISO and senior technology leadership on cyber risk, resilience, major technology investments, crisis readiness, and strategic security priorities.
• Translate cybersecurity strategy into funded roadmaps, measurable outcomes, workforce plans, vendor strategies, and prioritized improvement initiatives.
• Promote a shared-ownership model in which cybersecurity is embedded into technology planning, engineering, operational processes, and business initiatives.

Enterprise Security Architecture Leadership

• Establish and maintain the NBA’s enterprise cybersecurity architecture strategy, roadmap, standards, design patterns, and reference architectures in partnership with cybersecurity, infrastructure, engineering, data, product, and business technology leaders.
• Lead security architecture reviews for major technology initiatives and provide pragmatic guidance that balances cybersecurity risk, operational realities, resiliency, performance, cost, and business objectives.
• Develop and maintain reference architectures for cloud services, applications, infrastructure, identity, data platforms, media operations, arena technologies, operational technology, on-premises data centers, and third-party integrations.
• Ensure security requirements are incorporated early in technology planning, procurement, design, development, deployment, and lifecycle management.
• Provide architectural leadership for identity and access management, network segmentation, zero trust, encryption, logging, monitoring, cyber resiliency, data protection, and secure connectivity.
• Represent cybersecurity in enterprise architecture, governance, design review, and technology investment forums.

Security Operations, Detection & Incident Response

• Lead enterprise security operations, including continuous monitoring, threat detection, threat hunting, incident triage, containment, investigation, recovery coordination, and post-incident improvement.
• Define the strategy and operating model for security information and event management, detection engineering, automation, orchestration, case management, and operational metrics.
• Improve visibility across cloud, hybrid, on-premises, endpoint, identity, application, regional office, data center, arena, game, event, and broadcast environments.
• Establish clear incident response roles, severity criteria, escalation protocols, executive communications, evidence handling expectations, and coordination with Legal, Privacy, Communications, business continuity, and external partners.
• Lead readiness planning and cyber support for marquee events, games, broadcasts, and other high-visibility business operations, including tabletop exercises and scenario-based testing.
• Drive continuous improvement through after-action reviews, lessons learned, control validation, and remediation tracking.

Cloud, Infrastructure & Platform Security

• Partner with Cloud Engineering, Infrastructure, Enterprise Technology, and product teams to define and implement security standards across cloud, hybrid, SaaS, and on-premises environments.
• Guide secure design and operation of centralized logging, cloud-native monitoring, network telemetry, packet visibility, endpoint protection, identity protection, deception capabilities, and infrastructure detection and response.
• Ensure architectural decisions enhance operational visibility, detection quality, resilience, recoverability, and response effectiveness.
• Provide oversight for security design and operational support across regional offices, data centers, global deployments, and critical enterprise platforms.
• Collaborate with platform owners to reduce control gaps, technical debt, unsupported configurations, and inconsistent implementations.

Arena Cybersecurity Design & Standards

• Own the development, maintenance, approval, and communication of NBA arena cybersecurity standards, and minimum requirements.
• Provide standards and requirements for secure network segmentation, remote access, identity, logging, monitoring, vulnerability management, incident response, resilience, and third-party connectivity.
• Define cybersecurity requirements for arena IT and operational technology environments, including building automation systems, display control systems, game and event technologies, broadcast-related systems, physical security technology integrations, and other accessible or connected arena systems.
• Establish clear roles and responsibilities among the league office, teams, arena operators, technology providers, and service partners for security controls, monitoring, incident reporting, response, remediation, and evidence collection.
• Lead or oversee arena cybersecurity assessments, control validation, risk reviews, penetration testing strategy, remediation prioritization, exception management, and executive reporting.
• Partner with teams and arena technology leaders to tailor secure designs to venue-specific needs while maintaining consistent minimum standards and league-wide visibility.
• Create a scalable support model for arena onboarding, architectural consultation, implementation assistance, operational troubleshooting, incident escalation, and continuous improvement.
• Coordinate cyber readiness for games and events, including exercises, communication protocols, dependency mapping, and recovery expectations for critical arena services.

Threat, Exposure & Control Validation

• Use risk, threat, asset criticality, exploitability, and business impact to prioritize remediation and investment decisions.
• Partner with application security, engineering, infrastructure, and third parties to drive timely and sustainable remediation.
• Ensure detection and prevention controls are regularly tested against relevant threat scenarios and adjusted based on results.

AI & Emerging Technology Security

• Assist with the enablement of secure adoption of generative AI, machine learning, automation, and emerging technologies through clear architecture standards, operational controls, and risk-based governance. Partner with technology, data, product, Legal, Privacy, and business teams to assist with model governance, data protection, third-party AI services, secure development, monitoring, and evolving threats.
• Evaluate and implement emerging cybersecurity technologies and automation opportunities that improve speed, scale, visibility, analytical quality, and operational effectiveness in support of industry leading security operations. Balance innovation opportunities with practical security, compliance, resilience, and budget considerations.

Governance, Risk, Compliance & Metrics

• Assist with aligning architecture and operations with applicable NBA policies, contractual requirements, and recognized frameworks such as ISO 27001, CIS Controls, and SOC 2.
• Partner with Governance, Risk & Compliance, Legal, Privacy, Internal Audit, and Enterprise Technology to assess risk, document decisions, manage exceptions, and sustain effective controls.
• Develop executive-level metrics and dashboards that communicate operational effectiveness, detection and response maturity, architecture adoption, arena compliance, remediation progress, risk reduction, resilience, and strategic outcomes.
• Ensure operational procedures, architecture standards, incident playbooks, and technical documentation remain current, usable, and auditable.
• Provide clear, fact-based reporting to executive leadership and other governance bodies.

Business Partnership, Vendor Management & Financial Stewardship

• Build trusted relationships across technology and business organizations and translate complex cyber risks into actionable business recommendations.
• Influence enterprise technology decisions through risk analysis, operational evidence, and architectural guidance.
• Oversee strategic security partners, managed services, and technology vendors, including service quality, accountability, roadmap alignment, risk, and value realization.
• Develop and manage operating and capital plans for the combined operations and architecture portfolio, balancing risk reduction, resilience, innovation, and cost effectiveness.
• Coordinate with external partners, venues, teams, and service providers during major incidents, assessments, exercises, and technology changes.

Leadership & Organizational Development

• Lead, mentor, and develop cybersecurity leaders, architects, engineers, analysts, incident responders, and technical specialists.
• Create a culture of collaboration, inclusion, accountability, sound judgment, operational discipline, innovation, and continuous improvement.
• Establish succession plans, role clarity, development pathways, and training priorities for critical technical and leadership capabilities.
• Promote effective partnership among Cybersecurity, Engineering, Infrastructure, Product, Data, Media, Basketball Operations, teams, and arena stakeholders.
• Attract and retain high-performing talent and supplement internal capabilities with appropriate external expertise.

Required Education & Professional Experience

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline; master’s degree preferred.
• 15+ years of progressive experience across cybersecurity, technology operations, architecture, engineering, incident response, or related disciplines.
• 8+ years of leadership experience across enterprise security operations, cybersecurity architecture, cloud security, infrastructure security, or a comparable technical portfolio.
• Demonstrated success leading complex cybersecurity capabilities in global, highly visible, or operationally demanding environments.
• Experience developing enterprise architecture standards and operating security capabilities across cloud-native, hybrid, SaaS, application, infrastructure, identity, data, and operational technology environments.
• Experience leading major cyber incidents, crisis coordination, executive communications, exercises, and post-incident improvement.
• Experience establishing standards, governance, assessment, and support models across distributed or independently operated environments; venue, sports, media, entertainment, critical infrastructure, or large-event experience is strongly preferred.
• Demonstrated experience influencing enterprise-wide technology decisions and collaborating with executive leaders, engineers, operators, business stakeholders, legal teams, and external partners.
• Experience managing leaders, multidisciplinary technical teams, strategic vendors, and significant cybersecurity investments.

Knowledge, Skills & Abilities

• Deep expertise in security operations, incident response, detection engineering, threat hunting, security architecture, cloud security, infrastructure security, identity, network security, and cyber resilience.
• Strong understanding of modern enterprise and venue technology environments, including cloud services, network segmentation, remote access, SaaS, operational technology, telemetry, logging, endpoint protection, and third-party connectivity.
• Ability to connect architecture decisions with operational outcomes, including visibility, detection quality, response speed, recoverability, reliability, and supportability.
• Strong knowledge of AWS, Azure, hybrid-cloud environments, modern application architectures, data platforms, automation, and emerging technologies.
• Working knowledge of generative AI security, AI governance, and evolving technology risk landscapes.
• Expertise with NIST CSF, NIST guidance for operational technology, ISO 27001, CIS Controls, SOC 2, and related industry standards.
• Exceptional leadership, collaboration, stakeholder management, negotiation, and executive communication skills.
• Demonstrated ability to lead through influence across complex, matrixed organizations and diverse external stakeholder groups.
• Strong business and financial acumen, with the ability to balance risk, operational needs, user experience, innovation, resilience, and cost.
• Ability to remain composed, decisive, and clear during high-pressure incidents and high-visibility events.

Preferred Certifications

One or more relevant certifications such as CISSP, CISM, GIAC, CCSP, SABSA, TOGAF, AWS or Azure security certifications, or equivalent demonstrated expertise.

Why This Role Matters

The Vice President, Cybersecurity Operations & Architecture serves as the strategic and operational bridge between secure design, effective cyber defense, business enablement, and resilience. By unifying architecture with operations, this leader will help ensure that security standards are practical, measurable, and sustainable, and that operational lessons continuously improve future designs. The role is especially important to protecting enterprise platforms, global offices, digital products, sensitive data, games, broadcasts, events, and arena technology, while enabling the NBA to innovate and operate with confidence.

Salary Range:

$360,000-$415,000

Job Posting Title:

Vice President

Employees currently are eligible to receive an annual discretionary performance bonus, awarded at the sole discretion of the Company and subject to any terms and conditions set by the Company. Employees and/or eligible dependents may be eligible to participate in the following Company-sponsored employee benefit programs: medical; dental; vision; life/AD&D insurance; short- and long-term disability; fertility and family-forming assistance; wellbeing allowance; educational assistance; mental health coaching/therapy; tax advantaged accounts such as HSA and healthcare/dependent care FSAs; a 401(k) retirement plan; and time off benefits that include vacation, sick time, and personal days.

We Consider Applicants For All Positions On The Basis Of Merit, Qualifications And Business Needs, And Without Regard To Race, Color, National Origin, Religion, Sex, Gender Identity, Age, Disability, Alienage Or Citizenship Status, Ancestry, Marital Status, Creed, Genetic Predisposition Or Carrier Status, Sexual Orientation, Veteran Status, Familial Status, Status As A Victim Of Domestic Violence Or Any Other Status Or Characteristic Protected By Applicable Federal, State, Or Local Law.

About the NBA

The National Basketball Association (NBA) is a global sports and media organization with the mission to inspire and connect people everywhere through the power of basketball. Built around five professional sports leagues: the NBA, WNBA, NBA G League, NBA 2K League and Basketball Africa League, the NBA has established a major international presence with games and programming available in 214 countries and territories in more than 50 languages, and merchandise for sale in more than 200 countries and territories on all seven continents. NBA rosters at the start of the 2025-26 season featured a record 135 international players from a record-tying 43 countries. The NBA's digital assets include NBA TV, NBA.com, the NBA App and NBA League Pass. The NBA has created one of the largest social media communities in the world, with more than 2.5 billion likes and followers globally across all leagues, team and player platforms. The NBA's Tap to Watch provides seamless access to local, national and global live game telecasts via the NBA App, NBA.com, third-party digital platforms and NBA partner platforms. NBA Cares, the NBA's global social impact platform, drives change on issues facing fans and communities in the areas of health and wellness, civic engagement, social justice and inclusion, and sustainability.