Senior Security Analyst - Vulnerability/Exposure Management

Brobston Group; Seattle (WA); Hybrid; USD 142,000 - 221,000; Full time

Benefits offered by this job

Medical/Vision/Dental

Retirement

Paid Time Away

Life Insurance

Disability

Merchandise Discount

EAP Resources

Job summary

Nordstrom, Inc. in Seattle is seeking a Senior Attack Surface Analyst to lead the triage of the external attack surface across cloud, on‑prem, and third‑party exposures.

The role emphasizes risk‑based prioritization, remediation guidance, and collaboration with partner teams in a hybrid Seattle office. Ideal candidates have 4+ years in security operations, strong scripting skills, multi‑cloud experience (AWS/Azure/GCP), and familiarity with MITRE ATT&CK.

Qualifications

• 4+ years in security operations, vulnerability management, network security, system administration, or related fields.
• Advanced knowledge of networking, system administration, cloud services, asset management, and cybersecurity principles.
• Expertise across cybersecurity domains including vulnerability management, cloud security, attack surface management, network security, and cyber hygiene.
• OSINT techniques and reconnaissance methodologies.
• Experience implementing cybersecurity controls in multi‑cloud environments (AWS, Azure, GCP).
• Familiarity with the MITRE ATT&CK framework, threat actor TTPs, and common attack vectors.
• Deep understanding of regulatory and compliance requirements (PCI, SOC2) for vulnerability and attack surface management.
• Proficiency in scripting languages (Python, PowerShell) for process automation.
• Strong communication skills, including writing for technical and executive audiences.

Responsibilities

• Lead the maintenance and growth of attack surface management tools and the reporting ecosystem.
• Drive process automation leveraging AI enablement to streamline attack surface discovery, triage, and remediation workflows.
• Lead the triage of critical vulnerability findings with partner teams and stakeholders, coordinating expedited remediation.
• Map and document Nordstrom’s attack surface with OSINT and reconnaissance activities.
• Correlate data across vulnerability identification, CSPM, CMDB, and threat intel to prioritize exposures.
• Collaborate with cybersecurity peers and partner teams to reduce the attack surface.
• Author enterprise‑level reports and dashboards on high‑risk vulnerabilities and mitigations.
• Develop, monitor, and troubleshoot automation of operational processes and tool integrations.
• Maintain Cybersecurity Standards, ASM SOPs, and runbooks.
• Engage with cybersecurity community and threat intel sources for latest threats.
• Support regulatory and compliance requirements including PCI, SOC2 with evidence collection.
• Mentor teammates and build knowledge through trainings and presentations.

Skills

Security operations

Networking

Sysadmin

Cloud services

Asset management

Cybersecurity principles

OSINT

Reconnaissance

AWS

Azure

GCP

MITRE ATT&CK

TTPs

PCI

SOC2

Python

PowerShell

Communication

Education

Bachelor’s or Master’s degree in IT, CS, Cybersecurity

Job description

Job Description

This position is offered as a hybrid role in the Seattle, WA area. You must be willing to work in office at the Nordstrom Seattle office for a minimum of 4 days per week to be considered for this position.

The Senior Attack Surface Analyst leads the triage of Nordstrom’s external attack surface through data-driven analysis of cloud, on-prem, and third-party exposures. This role drives down attack surface risk through risk-based prioritization, process improvement, and hands‑on remediation guidance for partner teams.

Key Responsibilities

• Lead the maintenance and growth of attack surface management tools and the reporting ecosystem: troubleshoot escalated tool and script failures, identify coverage and process gaps, develop solutions, and contribute to the design and implementation of net‑new capabilities.
• Drive process automation leveraging AI enablement to streamline attack surface discovery, triage, and remediation workflows, reducing manual effort and accelerating time to risk reduction.
• Lead the triage of critical vulnerability findings with partner teams and stakeholders, analyzing the risk of emergent vulnerabilities and patch releases and coordinating response for expedited remediation as needed.
• Map and document Nordstrom’s attack surface in collaboration with network and offensive security teams, through regular OSINT and reconnaissance activities, discovery scans, and dark web monitoring resources.
• Correlate data across vulnerability identification, cloud security posture management (CSPM), asset inventory (CMDB), and threat intelligence sources to prioritize vulnerabilities and exposures by risk.
• Collaborate with cybersecurity peers, technology partner teams, and other stakeholders to reduce the attack surface by researching and guiding appropriate mitigation and remediation.
• Author enterprise-level communications, custom reports, dashboards, and metrics on the highest‑risk vulnerabilities and recommended mitigation strategies.
• Develop, monitor, and troubleshoot automation of operational processes and tool integrations.
• Maintain Cybersecurity Standards, Attack Surface Management standard operating procedures, and runbooks.
• Engage with the cybersecurity community and threat intelligence sources to share and consume the latest information on threats, attack vectors, and remediation workarounds.
• Support regulatory and compliance requirements (e.g., PCI, SOC2), including capturing evidence and artifacts related to vulnerability scanning and reporting.
• Develop teammates’ domain expertise through mentorship, presentations, and knowledge‑sharing sessions, and build your own through trainings, industry presentations, and certifications.

Qualifications

Required

• 4+ years in security operations, vulnerability management, network security, system administration, or related fields.
• Advanced knowledge of networking, system administration, cloud services, asset management, and cybersecurity principles.
• Expertise across cybersecurity domains including vulnerability management, cloud security, attack surface management, network security, and cyber hygiene.
• Working knowledge of OSINT techniques and reconnaissance methodologies.
• Experience implementing cybersecurity controls in multi‑cloud environments (AWS, Azure, GCP).
• Familiarity with the MITRE ATT&CK framework, threat actor tactics, techniques, and procedures (TTPs), and common attack vectors.
• Deep understanding of the processes and controls needed to satisfy relevant regulatory and compliance requirements (e.g., PCI, SOC2) for vulnerability and attack surface management.
• Proficiency in scripting languages (e.g., Python, PowerShell) for process automation.
• Strong communication skills, including writing for technical and executive audiences.
• Bachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field; equivalent experience will be considered in lieu of a degree.

Preferred

• Proficiency in emerging AI technologies and their application within the attack surface management domain.
• Experience coaching or mentoring more junior analysts.
• Relevant certifications (e.g., Security+, GCIA, GCIH, GPEN, CISSP).

Pay Range Details

The pay range(s) below has been provided in compliance with state specific laws. Pay ranges may be different for other locations.

Pay offers are dependent on the location, as well as job‑related knowledge, skills, and experience.

$142,000.00 - $220,500.00 Annual

We’ve got you covered…

Our employees are our most important asset and that’s reflected in our benefits. Nordstrom is proud to offer a variety of benefits to support employees and their families, including:

• Medical/Vision, Dental, Retirement and Paid Time Away
• Life Insurance and Disability
• Merchandise Discount and EAP Resources

This position may be eligible for performance‑based incentives/bonuses. Benefits include 401k, medical/vision/dental/life/disability insurance options, PTO accruals, Holidays, and more. Eligibility requirements may apply based on location, job level, classification, and length of employment. Learn more in the Nordstrom Benefits Overview by copying and pasting the following URL into your browser: https://careers.nordstrom.com/pdfs/Ben_Overview_17-19.pdf

A few more important points...

The job posting highlights the most critical responsibilities and requirements of the job. It’s not all‑inclusive. There may be additional duties, responsibilities and qualifications for this job.

For Los Angeles or San Francisco applicants: Nordstrom is required to inform you that we conduct background checks after conditional offer and consider qualified applicants with criminal histories in a manner consistent with legal requirements per Los Angeles, Cal. Muni. Code 189.04 and the San Francisco Fair Chance Ordinance. For additional state and location specific notices, please refer to the Legal Notices document within the FAQ section of the Nordstrom Careers site.

Applicants with disabilities who require assistance or accommodation should contact the nearest Nordstrom location, which can be identified at www.nordstrom.com (http://www.nordstrom.com/).

Please be mindful that there may be legal notices and requirements related to this job posting that are specific to your state. Review the Career Site FAQ’s (https://careers.nordstrom.com/#/contact-us/faq) for relevant information and guidelines.

Nordstrom keeps job postings open for at least one day after the posting date.

© 2026 Nordstrom, Inc