Compliance Analyst 2 - PCI (Hybrid - Seattle)

Nordstrom•Seattle, WA

4d•$121,500 - $188,500•Hybrid

About The Position

Nordstrom’s Governance, Risk & Compliance team is seeking a Compliance Analyst to help build and support its Continuous Compliance Framework (CCF), Financial Control Audit, and PCI DSS programs. The programs are actively maturing, and the analyst will contribute to control testing, evidence management, RACI and governance design, program metrics, and process improvements. The role will work closely with senior analysts and may take on direct ownership of specific CCF or PCI modules as experience grows. The analyst will conduct technical control testing, support PCI DSS scoping and annual assessment activities, maintain asset and evidence records, track findings and remediation, and help prepare for audits and QSA fieldwork. The role also involves using AI and automation to improve evidence collection, control testing, and documentation while checking the accuracy of AI-generated outputs and escalating issues that fall outside established procedures. This is a hybrid position in Seattle, Washington. Candidates must be available to work at Nordstrom’s corporate headquarters at least four days per week.

Requirements

At least 2 years of hands-on professional experience running PCI DSS assessments, along with CCF and/or SOX experience or equivalent.
Working understanding of at least one relevant framework or standard, such as PCI DSS, NIST 800-30/CSF, ISO 27005, SOX, or HIPAA, and ability to apply it to routine scenarios.
Experience with or strong aptitude for hands-on technical control testing and gap analysis, such as firewall rule reviews, access reviews, and log configuration checks.
Experience building or maintaining RACIs, or a strong understanding of documenting control ownership and accountability.
Interest in and aptitude for metrics, including helping design or track KPIs/KRIs.
Experience using AI and automation to improve compliance work and evaluate which tasks benefit from automation versus human review.
Strong organizational skills and ability to manage evidence collection, testing, and documentation across two programs.
Clear written and verbal communication skills, including the ability to translate technical findings into business-friendly language.
Ability to work with minimal supervision on established processes and recognize when to escalate.
Availability to work in Nordstrom’s Seattle corporate headquarters at least 4 days per week.

Nice To Haves

Pursuing or holding an associate-level certification such as CISA, CRISC, ISO 27001 Implementer, CIPM, or CIPP.
Experience with a GRC platform such as ServiceNow, OnSpring, AuditBoard, Archer, or similar.
Familiarity with AWS, Azure, or GCP environments as they relate to compliance scope.

Responsibilities

Conduct hands-on testing of CCF controls using established methodologies and document results clearly.
Help build and maintain the CCF module in Nordstrom’s GRC tool, including control status, testing schedules, evidence records, and ownership assignments.
Build and maintain RACIs for CCF controls and document clear ownership and accountability.
Collect, organize, and validate evidence from control owners, following up on gaps or missing documentation.
Help build and test AI-assisted and automated workflows for evidence collection and control testing, evaluating which tasks can be automated effectively.
Review anomalies, exceptions, and gaps surfaced by automated evidence pulls or AI-assisted review, and involve senior analysts as needed.
Support basic remediation recommendations and track remediation activities and status updates.
Support design of CCF KPIs and KRIs and help translate testing and remediation data into useful metrics.
Conduct technical control testing for PCI DSS v4.x and Financial Control Audit, including firewall rule reviews, access reviews, patch compliance, SDLC, change management, and log configuration checks.
Support PCI DSS scoping, evidence collection, and control testing across the annual assessment cycle.
Help maintain the CDE asset inventory, including network segmentation documentation, data flow diagrams, and system component registers.
Build and maintain RACIs and governance documentation for PCI and Financial Control Audit programs.
Assist with periodic control testing by scheduling tests, requesting evidence, and tracking exceptions through resolution.
Support QSA fieldwork by coordinating document requests and preparing evidence packages under senior analyst guidance.
Support PCI KPI and KRI design and track outcomes such as open finding age, control test pass rates, and inventory coverage.
Apply PCI DSS requirements to routine technical assessment scenarios and escalate situations outside established procedures.
Organize and maintain evidence repositories and information records.
Compile information from control owners, tickets, and prior assessments into clear summaries.
Use AI tools to draft and summarize documentation, verify output accuracy, and share lessons about their appropriate use.
Create and update process documentation in business-friendly language and coordinate documentation review cycles.
Develop basic reports on control status, testing progress, and remediation metrics.
Execute recurring GRC activities, including findings updates, assessment tickets, and evidence tracking, with minimal supervision.
Apply established procedures to routine technical assessment work, recognize exceptions, and escalate them to senior analysts or program owners.
Quality-check deliverables before handoff and support audit and assessment preparation and team handoffs.
Monitor operational metrics and flag process improvement opportunities.
Take on increasing ownership of specific CCF and/or PCI modules as experience grows.