Cybersecurity Manager, Vulnerability/Exposure Management (Hybrid - Seattle)

Nordstrom, Inc.; Seattle (WA); Hybrid; USD 166,000 - 258,000; Full time

Benefits offered by this job

Medical/Vision

Dental

Retirement

Paid Time Away

Life Insurance

Disability

Merchandise Discount

EAP Resources

Job summary

Nordstrom, Inc. in Seattle, WA, seeks a Manager of Attack Surface Management to lead a team and partner with cybersecurity and technology groups. The role emphasizes proactive risk reduction across cloud, on-premises, and third-party environments in a hybrid in-office setting.

The candidate will drive program growth, implement new capabilities, and ensure timely remediation with executives’ visibility. This leadership role requires strong collaboration and AI-enabled security tooling awareness.

Qualifications

• 6+ years in security operations, vulnerability management, offensive security, or attack surface management, including 2+ years leading a team or in a senior role.
• Experience building or growing an attack surface or exposure management program in an enterprise.
• Proven mentoring ability and career development for analysts.
• Deep knowledge of MITRE ATT&CK, TTPs, and common attack vectors.
• Experience implementing cloud security controls in multi-cloud environments (AWS, Azure, GCP).
• Proficiency in scripting for automation (Python/PowerShell).
• Strong leadership and ability to present to senior leadership.

Responsibilities

• Lead and develop a team of attack surface analysts, set priorities, assign work, and mentor.
• Grow the attack surface management program; set roadmap and implement new capabilities.
• Own Nordstrom's attack surface map with collaboration across security teams; use dark web monitoring.
• Direct risk-based triage of critical vulnerabilities and expedited remediation with stakeholders.
• Lead enterprise-wide initiatives to reduce exposures and drive architectural changes.
• Improve attack surface processes and tooling; explore AI to improve discovery and prioritization.
• Collaborate with AppSec, DevOps, and cloud teams to secure deployments and design secure-by-design systems.
• Develop and present metrics and executive reporting on attack surface risk and remediation progress.
• Maintain Attack Surface Management SOPs and runbooks; ensure compliance activities (e.g., PCI).
• Lead evaluation and implementation of tools; manage vendor relationships, budget, and timelines.
• Maintain domain expertise through trainings, industry events, and threat intelligence sources.

Skills

Leadership

Attack Surface

Vuln Management

Cloud Security

MITRE ATT&CK

Scripting

Communication

Stakeholder Mgmt

Education

IT/Cybersecurity degree

Tools

CSPM tools

Vulnerability scanners

Attack surface platforms

Network security tools

Cloud security tools

Job description

Job Description

This role is offered ashybridin Seattle, WA. Candidates must be available to work in office at the Nordstrom corporate headquarters a minimum of 4 days/week to be considered for this position.

The Manager, Attack Surface Management leads the team that champions reduction of Nordstrom’s attack surface through continuous identification, assessment, and escalation of the highest-risk exposures, along with the actions needed to manage that risk. As a leader on the Attack Surface Management team, this role builds and develops analysts, partners closely with cybersecurity and technology teams to prioritize risk and drive remediation, and automates processes that secure the technology landscape across cloud, on-premises, and third-party environments.

Key Responsibilities

• Lead, coach, and develop a team of attack surface analysts, setting priorities, assigning work, and supporting growth through mentorship, training, certification support, and knowledge-sharing.

• Lead the growth of the attack surface management program, set its roadmap, and drive the design and implementation of net-new capabilities that improve visibility into exposures across cloud, on-premises, and third-party environments.

• Own the map of Nordstrom’s attack surface through collaboration with network and offensive security teams, directing regular assessments and reconnaissance activities and leveraging dark web monitoring resources.

• Direct the risk-based triage of critical vulnerabilities and emergent exposures alongside partner teams and stakeholders, coordinating expedited remediation and managing remediation timelines.

• Lead data-driven, risk-prioritized, enterprise-wide initiatives to reduce vulnerabilities and exposures across Nordstrom’s technologies; identify opportunities and champion architectural changes that reduce attack surface.

• Continuously drive improvements in attack surface management processes, methodologies, and security toolsets, automating where possible and evaluating how emerging AI technologies can improve discovery, prioritization, and reporting.

• Partner with threat intelligence and offensive security teams to bring threat actor activity, zero-day exploits, and MITRE ATT&CK techniques into exposure prioritization and validation.

• Collaborate with AppSec, DevOps, and cloud platform teams to secure deployments and integrate security best practices into the design of software and related systems, ensuring a secure-by-design approach.

• Develop and present metrics and executive reporting on attack surface risk, remediation progress, and operational efficiency to senior leadership.

• Maintain Cybersecurity Standards, Attack Surface Management standard operating procedures, and runbooks.

• Lead compliance activities for the domain, including evidence validation and submission, proactive control evaluation and mitigation of gaps, and assessments (e.g., PCI).

• Lead evaluation, selection, and implementation of attack surface and exposure management tools; manage vendor relationships, budget, and project timelines.

• Maintain domain expertise by completing trainings, attending industry presentations, obtaining certifications, engaging with the cybersecurity community, and consuming threat intelligence sources.

Qualifications

Required

• 6+ years in security operations, vulnerability management, offensive security, or attack surface management, including 2+ years leading a team or in a senior or lead capacity.

• Demonstrated experience building, running, or growing an attack surface or exposure management program in an enterprise environment.

• Proven track record mentoring analysts and developing technical career paths.

• Deep knowledge of the MITRE ATT&CK framework, threat actor tactics, techniques, and procedures (TTPs), and common attack vectors.

• Knowledge of offensive security methodologies, external reconnaissance, and ethical hacking principles and practices.

• Experience implementing cloud security controls in a multi-cloud environment (AWS, Azure, GCP), including cloud asset exposure such as AWS S3 buckets and Azure Blob storage.

• Working knowledge of cybersecurity tools including vulnerability identification, cloud security posture management (CSPM), attack surface and exposure management platforms, and network security tools.

• Proficiency in scripting languages (e.g., Python, PowerShell) for process automation.

• Working knowledge of emerging AI technologies and how they can be applied within the attack surface management domain.

• Advanced knowledge of networking, system administration, cloud services, asset management, and enterprise IT architecture principles.

• Understanding of the processes and controls needed to satisfy relevant regulatory and compliance requirements (e.g., PCI) for vulnerability and attack surface management.

• Strong leadership and communication skills, including the ability to translate technical exposure data for business audiences, present to senior leadership, and influence across technical and business teams.

• Bachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field; equivalent experience will be considered in lieu of a degree.

Preferred

• Experience managing budgets, vendor relationships, and security tool evaluations.

• Experience with CVSS, risk prioritization frameworks, and threat intelligence platforms for exposure prioritization.

• Awareness of cyber hygiene best practices including patch management, hardening, secure configuration management, and lifecycle management.

• Demonstrated thought leadership on the application of emerging AI technologies within cybersecurity domains.

• Advanced certifications (e.g., OSCE, GREM, CISSP, CISM).

Pay Range Details

The pay range(s) below has been provided in compliance with state specific laws. Pay ranges may be different for other locations.
Pay offers are dependent on the location, as well as job-related knowledge, skills, and experience.

$166,000.00 - $258,000.00 Annual

We’ve got you covered…

Our employees are our most important asset and that’s reflected in our benefits.Nordstrom is proud to offer a variety of benefits to support employees and their families, including:

• Medical/Vision, Dental, Retirement and Paid Time Away
• Life Insurance and Disability
• Merchandise Discount and EAP Resources

This position may be eligible for performance-based incentives/bonuses. Benefits include 401k, medical/vision/dental/life/disability insurance options, PTO accruals, Holidays, and more. Eligibility requirements may apply based on location, job level, classification, and length of employment. Learn more in the Nordstrom Benefits Overview by copying and pasting the following URL into your browser: https://careers.nordstrom.com/pdfs/Ben_Overview_17-19.pdf

A few more important points...

The job posting highlights the most critical responsibilities and requirements of the job. It’s not all-inclusive. There may be additional duties, responsibilities and qualifications for this job.

For Los Angeles or San Francisco applicants: Nordstrom is required to inform you that we conduct background checks after conditional offer and consider qualified applicants with criminal histories in a manner consistent with legal requirements per Los Angeles, Cal. Muni. Code 189.04 and the San Francisco Fair Chance Ordinance. For additional state and location specific notices, please refer to the Legal Notices document within the FAQ section of the Nordstrom Careers site.

Applicants with disabilities who require assistance or accommodation should contact the nearest Nordstrom location, which can be identified at www.nordstrom.com.

Please be mindful that there may be legal notices and requirements related to this job posting that are specific to your state. Review the Career Site FAQ’s for relevant information and guidelines.