Senior Security Analyst - Vulnerability/Exposure Management (Hybrid - Seattle)

Nordstrom; Seattle (WA); Hybrid; USD 142,000 - 221,000; Full time

Benefits offered by this job

Medical/Vision/Dental

Retirement plan

Paid Time Off

Life Insurance & Disability

Merchandise Discount

EAP Resources

Job summary

Nordstrom, Inc. in Seattle, WA is seeking a Senior Attack Surface Analyst for a hybrid role requiring in-office presence at least 4 days per week.

You will drive attack surface risk reduction across cloud, on-prem, and third-party surfaces, with hands-on remediation guidance and data-driven prioritization. You will automate discovery and triage, coordinate with partner teams, and produce enterprise reports on high-risk vulnerabilities.

Qualifications

• 4+ years in security operations or related fields.
• Advanced networking, cloud, asset management, and cybersecurity knowledge.
• Experience with vulnerability management, cloud security, and attack surface domains.
• Familiarity with OSINT methods and reconnaissance.
• Experience in multi-cloud environments (AWS, Azure, GCP).
• Knowledge of MITRE ATT&CK and regulatory requirements (PCI, SOC2).
• Proficient scripting for automation; strong written and verbal communication.
• Degree in IT/CS/Cybersecurity or equivalent experience.

Responsibilities

• Lead attack surface management initiatives across cloud, on-prem, and third-party exposures.
• Automate discovery, triage, and remediation workflows using AI and tooling.
• Triage critical vulnerabilities with partners and coordinate expedited remediation.
• Document Nordstrom's attack surface with OSINT and reconnaissance activities.
• Correlate data from CSPM, CMDB, and threat intel to prioritize risks.
• Produce executive-level reports and dashboards on high-risk findings.
• Mentor teammates and contribute to training and certifications.

Skills

Security operations

Vulnerability management

Networking basics

Cloud services knowledge

Scripting (Python/PowerShell)

Executive communication

Education

Bachelor’s or Master’s in IT/CS/Cybersecurity

Tools

AWS/Azure/GCP

OSINT techniques

Attack surface tools

Job description

Job Description

This position is offered as a hybrid role in the Seattle, WA area. You must be willing to work in office at the Nordstrom Seattle office for a minimum of 4 days per week to be considered for this position.

The Senior Attack Surface Analyst leads the triage of Nordstrom's external attack surface through data-driven analysis of cloud, on-prem, and third-party exposures. This role drives down attack surface risk through risk-based prioritization, process improvement, and hands-on remediation guidance for partner teams.

Key Responsibilities

• Lead the maintenance and growth of attack surface management tools and the reporting ecosystem: troubleshoot escalated tool and script failures, identify coverage and process gaps, develop solutions, and contribute to the design and implementation of net-new capabilities.
• Drive process automation leveraging AI enablement to streamline attack surface discovery, triage, and remediation workflows, reducing manual effort and accelerating time to risk reduction.
• Lead the triage of critical vulnerability findings with partner teams and stakeholders, analyzing the risk of emergent vulnerabilities and patch releases and coordinating response for expedited remediation as needed.
• Map and document Nordstrom's attack surface in collaboration with network and offensive security teams, through regular OSINT and reconnaissance activities, discovery scans, and dark web monitoring resources.
• Correlate data across vulnerability identification, cloud security posture management (CSPM), asset inventory (CMDB), and threat intelligence sources to prioritize vulnerabilities and exposures by risk.
• Collaborate with cybersecurity peers, technology partner teams, and other stakeholders to reduce the attack surface by researching and guiding appropriate mitigation and remediation.
• Author enterprise-level communications, custom reports, dashboards, and metrics on the highest-risk vulnerabilities and recommended mitigation strategies.
• Develop, monitor, and troubleshoot automation of operational processes and tool integrations.
• Maintain Cybersecurity Standards, Attack Surface Management standard operating procedures, and runbooks.
• Engage with the cybersecurity community and threat intelligence sources to share and consume the latest information on threats, attack vectors, and remediation workarounds.
• Support regulatory and compliance requirements (e.g., PCI, SOC2), including capturing evidence and artifacts related to vulnerability scanning and reporting.
• Develop teammates' domain expertise through mentorship, presentations, and knowledge-sharing sessions, and build your own through trainings, industry presentations, and certifications.

Qualifications

Required

• 4+ years in security operations, vulnerability management, network security, system administration, or related fields.
• Advanced knowledge of networking, system administration, cloud services, asset management, and cybersecurity principles.
• Expertise across cybersecurity domains including vulnerability management, cloud security, attack surface management, network security, and cyber hygiene.
• Working knowledge of OSINT techniques and reconnaissance methodologies.
• Experience implementing cybersecurity controls in multi-cloud environments (AWS, Azure, GCP).
• Familiarity with the MITRE ATT&CK framework, threat actor tactics, techniques, and procedures (TTPs), and common attack vectors.
• Deep understanding of the processes and controls needed to satisfy relevant regulatory and compliance requirements (e.g., PCI, SOC2) for vulnerability and attack surface management.
• Proficiency in scripting languages (e.g., Python, PowerShell) for process automation.
• Strong communication skills, including writing for technical and executive audiences.
• Bachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field; equivalent experience will be considered in lieu of a degree.

Preferred

• Proficiency in emerging AI technologies and their application within the attack surface management domain.
• Experience coaching or mentoring more junior analysts.
• Relevant certifications (e.g., Security+, GCIA, GCIH, GPEN, CISSP).

Pay Range Details

The pay range(s) below has been provided in compliance with state specific laws. Pay ranges may be different for other locations. Pay offers are dependent on the location, as well as job-related knowledge, skills, and experience.

$142,000.00 - $220,500.00 Annual

We've got you covered…

Our employees are our most important asset and that's reflected in our benefits. Nordstrom is proud to offer a variety of benefits to support employees and their families, including:

• Medical/Vision, Dental, Retirement and Paid Time Away
• Life Insurance and Disability
• Merchandise Discount and EAP Resources

This position may be eligible for performance-based incentives/bonuses. Benefits include 401k, medical/vision/dental/life/disability insurance options, PTO accruals, Holidays, and more. Eligibility requirements may apply based on location, job level, classification, and length of employment. Learn more in the Nordstrom Benefits Overview by copying and pasting the following URL into your browser: https://careers.nordstrom.com/pdfs/Ben_Overview_17-19.pdf

A few more important points...

The job posting highlights the most critical responsibilities and requirements of the job. It's not all-inclusive. There may be additional duties, responsibilities and qualifications for this job.

For Los Angeles or San Francisco applicants: Nordstrom is required to inform you that we conduct background checks after conditional offer and consider qualified applicants with criminal histories in a manner consistent with legal requirements per Los Angeles, Cal. Muni. Code 189.04 and the San Francisco Fair Chance Ordinance. For additional state and location specific notices, please refer to the Legal Notices document within the FAQ section of the Nordstrom Careers site.

Applicants with disabilities who require assistance or accommodation should contact the nearest Nordstrom location, which can be identified at www.nordstrom.com.

Please be mindful that there may be legal notices and requirements related to this job posting that are specific to your state. Review the Career Site FAQ's for relevant information and guidelines.

Nordstrom keeps job postings open for at least one day after the posting date.

2026 Nordstrom, Inc