Security Platform Engineer, Level 2

Jobtailor; Seattle (WA); On-site; USD 130,000 - 170,000; Full time

Job summary

Nordstrom is seeking a Security Platform Engineer to support a broad SPE portfolio, including EDR, DLP, data encryption, and SIEM. You will collaborate across IT, infrastructure, and application teams in a hybrid environment, ensuring high availability and cost efficiency.

You will monitor platform health, lead automation initiatives using Python/Bash/NodeJS, and contribute to incident response and platform change testing. Strong communication and architectural skills are essential for success.

Qualifications

• Must have 3+ years in security platform engineering or related roles.
• Hands-on scripting in Python, Bash, or NodeJS.
• Experience with EDR/DLP, encryption, CSPM, or SIEM.
• Familiarity with MITRE ATT&CK, NIST CSF, PCI DSS, CIS Controls.

Responsibilities

• Provide engineering and sustainment support across SPE platform portfolio.
• Partner with IT and application teams for security platform integrations across hybrid environments.
• Monitor platform health metrics and contribute to MB R/MPR reporting.
• Manage migrations, upgrades, and test plans with minimal disruption.
• Participate in on-call rotations for incidents and support CSIRT/SOC teams.

Skills

Python

Bash

NodeJS

EDR/SIEM

CI/CD

Splunk

Terraform

Docker

Kubernetes

Communication

Tools

Splunk

Terraform

Docker

Kubernetes

Job description

• Provide engineering and sustainment support across the full SPE platform portfolio — including EDR, DLP, data encryption, email security, CSPM, and SIEM — ensuring platforms are highly available, performant, and cost-effective.
• Partner with IT, infrastructure, and application teams to maintain seamless security platform integrations across Nordstrom’s hybrid on-prem, cloud, and retail store environments.
• Monitor and maintain platform health metrics — including EDR, Qualys, and Tanium agent coverage — and contribute to Monthly Business/Program Reviews (MBR/MPR) reporting.
• Manage security platform migrations, upgrades, and configuration changes with minimal business disruption; develop and execute detailed test plans for platform changes.
• Participate in an on‑call rotation for platform‑related incidents and support Threat Intel, CSIRT/SOC teams during security events requiring platform investigation or response.
• Design, develop, and maintain automation tooling and CI/CD pipelines that improve platform deployment, configuration management, and operational efficiency.
• Write and maintain engineering‑level documentation including architecture decisions, runbooks, deployment guides, and test plans.
• Contribute to the development of in‑house tooling using Python, Bash, and NodeJS to automate repetitive operational tasks and reduce manual toil across the platform portfolio.
• Apply infrastructure‑as‑code practices (Terraform) and containerization (Docker, Kubernetes) where applicable to platform deployment and management.
• Leverage AI tooling — including GitHub Copilot and Claude — to accelerate engineering workflows and improve team productivity.
• Partner with Threat Intel & Detection Engineering, SOC and CSIRT teams to ensure platform configurations align with active detection and incident response requirements.
• Collaborate with GRC teams to ensure security platforms meet compliance requirements across NIST CSF, PCI DSS, SOC 1/2, and related frameworks.
• Communicate clearly and effectively with technical and non‑technical stakeholders across engineering, IT, and business teams.
• Mentor junior engineers in both technical skills and engineering best practices; contribute to a culture of knowledge sharing and continuous improvement.

Requirements

• Minimum 3 years of experience in security platform engineering, security operations, or related technical roles supporting mission‑critical systems.
• Minimum 2 years of hands‑on experience with scripting or programming languages — preferably Python, Bash, or NodeJS/JavaScript.
• Experience with enterprise security platforms across two or more of the following domains: endpoint security (EDR/XDR), data loss prevention, data encryption, email security, CSPM, or SIEM.
• Working knowledge of security frameworks and standards including MITRE ATT&CK, NIST CSF, PCI DSS, and CIS Controls.
• Demonstrated ability to analyse log data, security alerts, and platform telemetry; Splunk or equivalent SIEM experience required.
• Experience developing automation tooling or contributing to CI/CD pipelines in an engineering environment.
• Strong written and oral communication skills; ability to translate technical concepts clearly for non‑technical stakeholders.
• Advanced understanding of systems design principles, technical architecture, and a track record of platform implementation and support.