Job Description

This position is offered as a hybrid role in the Seattle, WA area. You must be willing to work in office at the Nordstrom Seattle office for a minimum of 4 days per week to be considered for this position.

The Senior Attack Surface Analyst leads the triage of Nordstrom’s external attack surface through data-driven analysis of cloud, on-prem, and third-party exposures. This role drives down attack surface risk through risk-based prioritization, process improvement, and hands-on remediation guidance for partner teams.

Key Responsibilities

• Lead the maintenance and growth of attack surface management tools and the reporting ecosystem: troubleshoot escalated tool and script failures, identify coverage and process gaps, develop solutions, and contribute to the design and implementation of net-new capabilities.
• Drive process automation leveraging AI enablement to streamline attack surface discovery, triage, and remediation workflows, reducing manual effort and accelerating time to risk reduction.
• Lead the triage of critical vulnerability findings with partner teams and stakeholders, analyzing the risk of emergent vulnerabilities and patch releases and coordinating response for expedited remediation as needed.
• Map and document Nordstrom’s attack surface in collaboration with network and offensive security teams, through regular OSINT and reconnaissance activities, discovery scans, and dark web monitoring resources.
• Correlate data across vulnerability identification, cloud security posture management (CSPM), asset inventory (CMDB), and threat intelligence sources to prioritize vulnerabilities and exposures by risk.
• Collaborate with cybersecurity peers, technology partner teams, and other stakeholders to reduce the attack surface by researching and guiding appropriate mitigation and remediation.
• Author enterprise-level communications, custom reports, dashboards, and metrics on the highest-risk vulnerabilities and recommended mitigation strategies.
• Develop, monitor, and troubleshoot automation of operational processes and tool integrations.
• Maintain Cybersecurity Standards, Attack Surface Management standard operating procedures, and runbooks.
• Engage with the cybersecurity community and threat intelligence sources to share and consume the latest information on threats, attack vectors, and remediation workarounds.
• Support regulatory and compliance requirements (e.g., PCI, SOC2), including capturing evidence and artifacts related to vulnerability scanning and reporting.
• Develop teammates’ domain expertise through mentorship, presentations, and knowledge-sharing sessions, and build your own through trainings, industry presentations, and certifications.

Qualifications

Required

• 4+ years in security operations, vulnerability management, network security, system administration, or related fields.
• Advanced knowledge of networking, system administration, cloud services, asset management, and cybersecurity principles.
• Expertise across cybersecurity domains including vulnerability management, cloud security, attack surface management, network security, and cyber hygiene.
• Working knowledge of OSINT techniques and reconnaissance methodologies.
• Experience implementing cybersecurity controls in multi-cloud environments (AWS, Azure, GCP).
• Familiarity with the MITRE ATT&CK framework, threat actor tactics, techniques, and procedures (TTPs), and common attack vectors.
• Deep understanding of the processes and controls needed to satisfy relevant regulatory and compliance requirements (e.g., PCI, SOC2) for vulnerability and attack surface management.
• Proficiency in scripting languages (e.g., Python, PowerShell) for process automation.
• Strong communication skills, including writing for technical and executive audiences.
• Bachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field; equivalent experience will be considered in lieu of a degree.

Preferred

• Proficiency in emerging AI technologies and their application within the attack surface management domain.
• Experience coaching or mentoring more junior analysts.
• Relevant certifications (e.g., Security+, GCIA, GCIH, GPEN, CISSP).

Pay Range Details

The pay range(s) below has been provided in compliance with state specific laws. Pay ranges may be different for other locations. 
Pay offers are dependent on the location, as well as job-related knowledge, skills, and experience.

We’ve got you covered…

Our employees are our most important asset and that’s reflected in our benefits. Nordstrom is proud to offer a variety of benefits to support employees and their families, including:

• Medical/Vision, Dental, Retirement and Paid Time Away
• Life Insurance and Disability
• Merchandise Discount and EAP Resources

A few more important points...

The job posting highlights the most critical responsibilities and requirements of the job. It’s not all-inclusive. There may be additional duties, responsibilities and qualifications for this job.

For Los Angeles or San Francisco applicants: Nordstrom is required to inform you that we conduct background checks after conditional offer and consider qualified applicants with criminal histories in a manner consistent with legal requirements per Los Angeles, Cal. Muni. Code 189.04 and the San Francisco Fair Chance Ordinance. For additional state and location specific notices, please refer to the Legal Notices document within the FAQ section of the Nordstrom Careers site.

Applicants with disabilities who require assistance or accommodation should contact the nearest Nordstrom location, which can be identified at www.nordstrom.com. 

Please be mindful that there may be legal notices and requirements related to this job posting that are specific to your state. Review the Career Site FAQ’s for relevant information and guidelines.

Current Nordstrom employees: To apply, log into Workday, click the Careers button and then click Find Jobs.