Senior Threat Intel & Detection Engineer

Nordstrom, Inc.; Seattle, Northern (WA, KY); Hybrid; USD 142,000 - 221,000; Full time

Benefits offered by this job

Merchandise Discount

Job summary

Nordstrom, Inc. is seeking a Senior Security Engineer to join the TIDE team in Seattle. This hybrid role requires in-office presence at least 4 days a week and hands-on work across detection engineering, threat intelligence, and threat hunting to protect retail and e‑commerce environments.

You will design detection rules, operationalize threat intelligence, and lead automation efforts, partnering with SOC, IAM, and cloud teams to strengthen telemetry and incident response.

Qualifications

• 4+ years of professional experience in detection engineering, threat intelligence, SOC/IR, threat hunting, or security automation
• Proficient in writing detection logic in at least one enterprise SIEM or XDR; CrowdStrike NG-SIEM experience preferred
• Knowledge of MITRE ATT&CK technique/sub-technique mapping to telemetry and detection logic
• Hands-on experience with EDR analysis, behavioral anomaly detection, and post-exploitation investigations
• Experience with hypothesis-driven threat hunting and end-to-end hunt execution
• Scripting in Python and/or PowerShell for automation and log parsing
• Experience contributing to incident response for malware, identity-based attacks, or insider threats
• Strong written communication and documentation skills
• Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent experience

Responsibilities

• Design, develop, and maintain high-fidelity detection rules across endpoint, email, identity, network, and cloud domains
• Operationalize the full detection lifecycle from threat modeling to deployment and retirement
• Translate threat intelligence findings and hunt results into durable detection logic
• Collaborate with CSIRT and SOC to enrich investigations with adversary context
• Build automation to accelerate detection deployment, alert triage, and intel processing
• Mentor junior team members and partner with cross-functional teams to ensure telemetry quality and coverage

Skills

Detection engineering

Threat intelligence

Threat hunting

Security automation

Incident response

Investigation analysis

Education

Bachelor's degree in Computer Science or related field

Tools

CrowdStrike NG-SIEM (LogScale/CQL)

SIEM/XDR platforms

CrowdStrike Fusion

MISP

ThreatConnect

Recorded Future

Job description

Nordstrom, Inc. is seeking a Senior Security Engineer to join the TIDE team in Seattle. This hybrid role requires in-office presence at least 4 days a week and hands-on work across detection engineering, threat intelligence, and threat hunting to protect retail and e‑commerce environments.

You will design detection rules, operationalize threat intelligence, and lead automation efforts, partnering with SOC, IAM, and cloud teams to strengthen telemetry and incident response.