This role pays more than
89%
of similar roles. Most pay
$123,787–$181,250
— the shaded band above.
At the midpoint, this role pays about
$212k
versus about
$153k
for comparable roles.
Based on 240 similar postings.
Employer
About Nordstrom
Nordstrom is a leading American luxury department store chain offering a wide selection of clothing, shoes, accessories, and beauty products through its stores, Nordstrom Rack outlets, and online. Industry: Luxury Department Store Retail
Nordstrom currently has
33 open roles
on FindRole.
Listed pay typically runs
$142,000–$220,500
across 32 roles with salary data.
Senior 2 Cybersecurity Analyst - Attack Surface Management serves as a senior leader on the Attack Surface Management team focused on reducing risk by identifying and assessing high-risk exposures. The role involves developing new capabilities, automating processes, maintaining standard operating procedures, and collaborating with AppSec, DevOps, and cloud platform teams to ensure secure-by-design systems. You will manage an attack surface map through reconnaissance, dark web monitoring, and regular assessments while leading data-driven initiatives to mitigate vulnerabilities. Required skills include expertise in Python and PowerShell for automation, deep knowledge of the MITRE ATT&CK framework, and experience with multi-cloud security controls. The role addresses the technical challenge of securing a complex technology landscape by managing infrastructure risks, ensuring PCI compliance, and implementing advanced cybersecurity principles across various enterprise systems to proactively defend against common attack vectors.
Identify, assess, and escalate high-risk exposures to reduce the organization's attack surface.
Develop and implement solutions to improve visibility into security vulnerabilities and infrastructure risks.
Automate manual processes and tools to enhance operational efficiency in attack surface management.
Maintain comprehensive maps of the attack surface using reconnaissance, network data, and dark web monitoring.
Lead data-driven initiatives to prioritize and remediate vulnerabilities across enterprise technologies.
Collaborate with engineering teams to integrate security best practices into software and cloud deployments.
Manage compliance activities including evidence validation and mitigation of gaps for standards like PCI.
Develop metrics to measure the effectiveness of attack surface management programs and risk reduction.
What we're looking for
6+ years in security operations, vulnerability management, or offensive security domains, including experience in a senior or lead capacity.
Deep knowledge of the MITRE ATT&CK framework, threat actor TTPs, and common attack vectors.
Experience implementing cloud security controls in a multi-cloud environment.
Proficiency in scripting languages like Python or PowerShell for process automation.
Advanced knowledge of networking, system administration, cloud services, asset management, and cybersecurity principles.
Deep understanding of processes and controls to satisfy regulatory requirements such as PCI.
Bachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field (equivalent experience accepted).
Experience developing attack surface management capabilities, coaching junior analysts, and advanced certifications like OSCE, GREM, or CISSP (preferred); AI thought leadership (preferred).