Senior Security Analyst - Vulnerability/Exposure Management (Hybrid - Seattle)

Nordstrom•Seattle, WA

18h•$142,000 - $220,500•Hybrid

About The Position

This hybrid position is based in the Seattle, Washington area and requires working in the Nordstrom Seattle office at least four days per week. The Senior Attack Surface Analyst leads triage of Nordstrom’s external attack surface through data-driven analysis of cloud, on-premises, and third-party exposures. The role reduces attack surface risk through risk-based prioritization, process improvement, automation, and hands-on remediation guidance for partner teams. The position maintains and expands attack surface management tools and reporting, investigates escalated tool and script failures, identifies coverage and process gaps, and contributes to new capabilities. It drives AI-enabled automation across discovery, triage, and remediation; coordinates response to critical vulnerabilities; maps and documents the attack surface through OSINT, reconnaissance, discovery scans, and dark web monitoring; and correlates vulnerability, cloud security posture, asset inventory, and threat intelligence data to prioritize risk. The analyst collaborates with cybersecurity peers and technology partners, produces enterprise communications, reports, dashboards, and metrics, and maintains cybersecurity standards, procedures, and runbooks. The role also supports compliance evidence gathering, shares threat intelligence, and develops team expertise through mentorship and knowledge sharing.

Requirements

At least 4 years of experience in security operations, vulnerability management, network security, system administration, or a related field.
Advanced knowledge of networking, system administration, cloud services, asset management, and cybersecurity principles.
Expertise in vulnerability management, cloud security, attack surface management, network security, and cyber hygiene.
Working knowledge of OSINT techniques and reconnaissance methodologies.
Experience implementing cybersecurity controls in multi-cloud environments, including AWS, Azure, and GCP.
Familiarity with the MITRE ATT&CK framework, threat actor tactics, techniques, and procedures (TTPs), and common attack vectors.
Deep understanding of processes and controls needed to satisfy relevant vulnerability and attack surface management compliance requirements, such as PCI and SOC2.
Proficiency in scripting languages such as Python or PowerShell for process automation.
Strong written communication skills for technical and executive audiences.
Bachelor’s or master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent experience in lieu of a degree.

Nice To Haves

Proficiency in emerging AI technologies and their application to attack surface management.
Experience coaching or mentoring more junior analysts.
Relevant certifications such as Security+, GCIA, GCIH, GPEN, or CISSP.

Responsibilities

Lead the maintenance and growth of attack surface management tools and reporting, troubleshooting escalated tool and script failures, identifying gaps, developing solutions, and helping design and implement new capabilities.
Drive AI-enabled automation of attack surface discovery, triage, and remediation workflows to reduce manual effort and accelerate risk reduction.
Lead triage of critical vulnerability findings with partner teams and stakeholders; assess emergent vulnerabilities and patch releases and coordinate expedited remediation when needed.
Map and document Nordstrom’s attack surface with network and offensive security teams using OSINT, reconnaissance, discovery scans, and dark web monitoring resources.
Correlate vulnerability identification, CSPM, asset inventory (CMDB), and threat intelligence data to prioritize vulnerabilities and exposures by risk.
Collaborate with cybersecurity peers, technology partners, and stakeholders to research and guide mitigation and remediation that reduce the attack surface.
Create enterprise communications, custom reports, dashboards, and metrics on high-risk vulnerabilities and recommended mitigation strategies.
Develop, monitor, and troubleshoot automation of operational processes and tool integrations.
Maintain Cybersecurity Standards, Attack Surface Management standard operating procedures, and runbooks.
Engage with cybersecurity communities and threat intelligence sources to share and obtain information on threats, attack vectors, and remediation workarounds.
Support regulatory and compliance requirements such as PCI and SOC2, including gathering evidence and artifacts related to vulnerability scanning and reporting.
Develop teammates’ domain expertise through mentorship, presentations, and knowledge-sharing sessions, and develop personal expertise through training, industry presentations, and certifications.