Manager, Attack Surface Management

Nordstrom

. Lead, coach, and develop a team of attack surface analysts .

Posted 10/28/2026full-timeSeattle • Washington • United StatesMid-LevelSenior💰 $166,000 - $258,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in attack surface management, vulnerability assessment, and team leadership, with a strong focus on implementing security controls and compliance measures. Proficient in mentoring analysts and developing security programs while leveraging advanced technologies and methodologies.

Highest-signal resume keywords

Attack Surface ManagementMITRE ATT&CK KnowledgeCloud Security ImplementationTeam LeadershipVulnerability Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

PythonPowerShellVulnerability IdentificationNetwork Security ToolsCloud Security ControlsOffensive Security MethodologiesExternal ReconnaissanceSecurity Tool EvaluationsProcess AutomationEnterprise IT Architecture

Soft Skills

LeadershipCommunicationMentorship

Tools & Technologies

Attack Surface Management PlatformsCSPMThreat Intelligence PlatformsEmerging AI Technologies

Certifications & Qualifications

CISSPCISMOSCEGREM

Industry Keywords

Cybersecurity StandardsCompliance ControlsPCIRisk Prioritization FrameworksThreat Actor TTPs

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud PlatformPython

About the role

Key responsibilities & impact

Lead, coach, and develop a team of attack surface analysts
Set team priorities, assign work, and support growth through mentorship, training, certification support, and knowledge-sharing
Grow the attack surface management program, establish its roadmap, and implement new capabilities
Maintain Nordstrom’s attack surface map through assessments, reconnaissance, and dark web monitoring
Direct risk-based triage of critical vulnerabilities and emergent exposures
Coordinate expedited remediation and manage remediation timelines
Lead enterprise-wide initiatives to reduce vulnerabilities and exposures
Identify and champion architectural changes that reduce attack surface
Improve attack surface management processes, methodologies, and security toolsets, including automation and emerging AI applications
Partner with threat intelligence and offensive security teams on threat actor activity, zero-day exploits, and MITRE ATT&CK techniques
Collaborate with AppSec, DevOps, and cloud platform teams to integrate secure-by-design practices
Develop and present metrics and executive reporting to senior leadership
Maintain cybersecurity standards, standard operating procedures, and runbooks
Lead compliance activities, evidence validation, control evaluations, gap mitigation, and assessments such as PCI
Evaluate, select, and implement attack surface and exposure management tools
Manage vendor relationships, budget, and project timelines
Maintain domain expertise through training, industry presentations, certifications, community engagement, and threat intelligence consumption

Requirements

What you’ll need

6+ years in security operations, vulnerability management, offensive security, or attack surface management
2+ years leading a team or serving in a senior or lead capacity
Experience building, running, or growing an attack surface or exposure management program in an enterprise environment
Experience mentoring analysts and developing technical career paths
Deep knowledge of MITRE ATT&CK, threat actor TTPs, and common attack vectors
Knowledge of offensive security methodologies, external reconnaissance, and ethical hacking
Experience implementing cloud security controls in AWS, Azure, and GCP environments
Working knowledge of vulnerability identification, CSPM, attack surface and exposure management platforms, and network security tools
Proficiency in Python or PowerShell for process automation
Working knowledge of emerging AI technologies applied to attack surface management
Advanced knowledge of networking, system administration, cloud services, asset management, and enterprise IT architecture
Understanding of vulnerability and attack surface management compliance controls, including PCI
Strong leadership and communication skills, including presenting technical exposure data to senior leadership
Bachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field; equivalent experience considered in lieu of a degree
Preferred: experience managing budgets, vendor relationships, and security tool evaluations
Preferred: experience with CVSS, risk prioritization frameworks, and threat intelligence platforms
Preferred: awareness of patch management, hardening, secure configuration management, and lifecycle management
Preferred: advanced certifications such as OSCE, GREM, CISSP, or CISM

Benefits

Comp & perks

Medical/Vision, Dental, Retirement and Paid Time Away
Life Insurance and Disability
Merchandise Discount and EAP Resources
Performance-based incentives/bonuses may be available
401k
PTO accruals
Holidays
Flexible benefits eligibility based on location, job level, classification, and length of employment