Senior Attack Surface Analyst - Secure Cloud & Apps

Nordstrom, Inc.; Seattle, Northern (WA, KY); Hybrid; USD 166,000 - 258,000; Full time

Benefits offered by this job

Medical/Vision, Dental

Retirement and Paid Time Away

Life Insurance and Disability

Merchandise Discount and EAP Resources

Job summary

Qualifications

• 6+ years in security operations, vulnerability management, or offensive security, including senior/lead capacity.
• Deep knowledge of MITRE ATT&CK framework, TTPs, and attack vectors.
• Experience implementing cloud security controls in a multi-cloud environment.
• Proficiency in IT architecture principles and practices.
• Knowledge of offensive security methodologies and ethical hacking.
• Deep understanding of system landscape and data flow within the domain and across adjacent domains.
• Expertise in scripting languages for automation (Python, PowerShell).
• Advanced knowledge of networking, system administration, cloud services, asset management, and cybersecurity principles.
• Understanding of PCI compliance requirements for vulnerability/attack surface management.
• Strong leadership and communication skills.

Responsibilities

• Lead the growth of the attack surface management program and improve visibility into exposures.
• Develop and implement solutions to reduce exposures and automate where possible.
• Maintain Cybersecurity Standards, SOPs, and runbooks for attack surface management.
• Collaborate with AppSec, DevOps, and cloud teams to secure deployments and design secure-by-design systems.
• Maintain Nordstrom’s attack surface map with network and offensive security teams.
• Lead data-driven, risk-prioritized initiatives to reduce vulnerabilities across technologies.
• Develop metrics to measure operational efficiency and attack surface risk.
• Pursue domain expertise through training, conferences, and threat intelligence.
• Mentor teammates and lead knowledge-sharing sessions.
• Lead domain compliance activities including evidence validation and PCI assessments.

Skills

MITRE ATT&CK

Cloud security

IT architecture

Scripting (Python, PowerShell)

Networking basics

PCI compliance

Leadership & communication

Cybersecurity principles

Education

Bachelor’s or Master’s degree in IT/CS/Cybersecurity

Job description