Cybersecurity Manager, Vulnerability/Exposure Management (Hybrid - Seattle)

Nordstrom•Seattle, WA

4d•$166,000 - $258,000•Hybrid

About The Position

The Manager, Attack Surface Management leads the team responsible for reducing Nordstrom’s attack surface through continuous identification, assessment, and escalation of high-risk exposures, and by driving actions to manage that risk. The role builds and develops analysts, partners with cybersecurity and technology teams to prioritize risk and drive remediation, and automates processes that secure technology across cloud, on-premises, and third-party environments. This position is hybrid in Seattle, Washington, and requires working at Nordstrom’s corporate headquarters at least four days per week. The role also leads the attack surface management program and roadmap, directs risk-based exposure triage and enterprise-wide remediation initiatives, improves processes and tools, and communicates risk and progress to senior leadership. It oversees domain standards, compliance activities, tool selection and implementation, vendor relationships, budgets, and project timelines.

Requirements

At least 6 years of experience in security operations, vulnerability management, offensive security, or attack surface management, including at least 2 years leading a team or working in a senior or lead capacity.
Demonstrated experience building, running, or growing an attack surface or exposure management program in an enterprise environment.
Proven ability to mentor analysts and develop technical career paths.
Deep knowledge of the MITRE ATT&CK framework, threat actor tactics, techniques, and procedures, and common attack vectors.
Knowledge of offensive security methodologies, external reconnaissance, and ethical hacking principles and practices.
Experience implementing cloud security controls in a multi-cloud environment (AWS, Azure, and GCP), including cloud asset exposure such as AWS S3 buckets and Azure Blob storage.
Working knowledge of cybersecurity tools, including vulnerability identification, cloud security posture management (CSPM), attack surface and exposure management platforms, and network security tools.
Proficiency in scripting languages such as Python or PowerShell for process automation.
Working knowledge of emerging AI technologies and their application to attack surface management.
Advanced knowledge of networking, system administration, cloud services, asset management, and enterprise IT architecture principles.
Understanding of processes and controls needed to satisfy relevant regulatory and compliance requirements, such as PCI, for vulnerability and attack surface management.
Strong leadership and communication skills, including translating technical exposure data for business audiences, presenting to senior leadership, and influencing technical and business teams.
Bachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field; equivalent experience may be considered in place of a degree.

Nice To Haves

Experience managing budgets and vendor relationships and evaluating security tools.
Experience with CVSS, risk prioritization frameworks, and threat intelligence platforms for exposure prioritization.
Awareness of cyber hygiene best practices, including patch management, hardening, secure configuration management, and lifecycle management.
Demonstrated thought leadership on applying emerging AI technologies within cybersecurity domains.
Advanced certifications such as OSCE, GREM, CISSP, or CISM.

Responsibilities

Lead, coach, and develop attack surface analysts; set priorities, assign work, and support professional growth through mentorship, training, certification support, and knowledge-sharing.
Grow the attack surface management program, set its roadmap, and design and implement capabilities that improve exposure visibility across cloud, on-premises, and third-party environments.
Maintain a map of Nordstrom’s attack surface by collaborating with network and offensive security teams, directing assessments and reconnaissance, and using dark web monitoring resources.
Direct risk-based triage of critical vulnerabilities and emerging exposures, coordinate expedited remediation, and manage remediation timelines with partner teams and stakeholders.
Lead data-driven, risk-prioritized enterprise initiatives to reduce vulnerabilities and exposures, and identify and champion architectural changes that reduce the attack surface.
Improve attack surface management processes, methodologies, and security tools; automate where possible and evaluate emerging AI technologies for discovery, prioritization, and reporting.
Partner with threat intelligence and offensive security teams to incorporate threat actor activity, zero-day exploits, and MITRE ATT&CK techniques into exposure prioritization and validation.
Collaborate with AppSec, DevOps, and cloud platform teams to integrate security best practices into software and systems design and promote a secure-by-design approach.
Develop and present metrics and executive reports on attack surface risk, remediation progress, and operational efficiency to senior leadership.
Maintain Cybersecurity Standards, attack surface management standard operating procedures, and runbooks.
Lead domain compliance activities, including evidence validation and submission, proactive control evaluation, gap mitigation, and assessments such as PCI.
Lead evaluation, selection, and implementation of attack surface and exposure management tools; manage vendor relationships, budgets, and project timelines.
Maintain domain expertise through training, industry presentations, certifications, cybersecurity community engagement, and threat intelligence sources.