Senior Security Analyst - Vulnerability/Exposure Management (Hybrid - Seattle)

Nordstrom•Seattle, WA

1d•Hybrid

About The Position

This hybrid position is based in the Seattle, Washington area and requires working in Nordstrom’s Seattle office at least four days per week. The role leads triage of Nordstrom’s external attack surface through data-driven analysis of cloud, on-premises, and third-party exposures. It reduces attack-surface risk through risk-based prioritization, process improvement, automation, and hands-on remediation guidance for partner teams.

Requirements

At least 4 years of experience in security operations, vulnerability management, network security, system administration, or a related field.
Advanced knowledge of networking, system administration, cloud services, asset management, and cybersecurity principles.
Expertise in vulnerability management, cloud security, attack surface management, network security, and cyber hygiene.
Working knowledge of OSINT techniques and reconnaissance methodologies.
Experience implementing cybersecurity controls in multi-cloud environments, including AWS, Azure, and GCP.
Familiarity with the MITRE ATT&CK framework, threat actor tactics, techniques, and procedures, and common attack vectors.
Deep understanding of processes and controls needed to meet relevant vulnerability and attack surface management requirements, including PCI and SOC2.
Proficiency in scripting languages such as Python or PowerShell for process automation.
Strong communication skills, including writing for technical and executive audiences.
Bachelor’s or master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent experience in lieu of a degree.

Nice To Haves

Proficiency in emerging AI technologies and their application to attack surface management.
Experience coaching or mentoring more junior analysts.
Relevant certifications such as Security+, GCIA, GCIH, GPEN, or CISSP.

Responsibilities

Lead the maintenance and growth of attack surface management tools and reporting, including troubleshooting escalated tool and script failures, addressing coverage and process gaps, and contributing to new capabilities.
Automate attack-surface discovery, triage, and remediation workflows, including leveraging AI enablement to reduce manual effort and accelerate risk reduction.
Lead triage of critical vulnerability findings with partner teams and stakeholders; assess emergent vulnerabilities and patch releases and coordinate expedited remediation when needed.
Map and document Nordstrom’s attack surface with network and offensive security teams using OSINT, reconnaissance, discovery scans, and dark web monitoring resources.
Correlate vulnerability, CSPM, CMDB asset inventory, and threat intelligence data to prioritize vulnerabilities and exposures by risk.
Collaborate with cybersecurity peers, technology partner teams, and other stakeholders to research and guide mitigation and remediation.
Create enterprise-level communications, custom reports, dashboards, and metrics on high-risk vulnerabilities and recommended mitigations.
Develop, monitor, and troubleshoot automation of operational processes and tool integrations.
Maintain cybersecurity standards, attack surface management standard operating procedures, and runbooks.
Engage with the cybersecurity community and threat intelligence sources to exchange information about threats, attack vectors, and remediation workarounds.
Support regulatory and compliance requirements, including PCI and SOC2, by capturing evidence and artifacts related to vulnerability scanning and reporting.
Mentor teammates and develop their domain expertise through presentations and knowledge-sharing sessions; continue personal development through training, industry presentations, and certifications.