Security Engineer 2, Incident Response (Remote)

Nordstrom’s Computer Security & Incident Response Team (CSIRT) is a diverse team of security professionals that delivers a broad range of incident response services to monitor, identify, and respond to security events in an enterprise environment to protect Nordstrom’s customers, our employees, and our brands. 

As an Engineer 2, you will apply your security knowledge, technical expertise and communication skills to provide analysis, and guidance during incident response investigations. You will embrace new challenges with a positive attitude, identify and proactively resolve security issue, and display a curious mindset while learning new technologies or techniques.  In addition to performing incident response, you will help to grow and improve Nordstrom’s security posture via cross-team collaboration and help drive our program’s maturity through improved alerting and processes. 

You own this if you have...

• Bachelor’s degree in related field or equivalent working experience  

• 4+ years of IT experience, focused on security and incident response activities 

• At least one industry certification such as CISSP, CISA, CEH, GSEC, GCFE, CySA+, Sec+ 

• Able to write scripts/code using one of the following: Python, Bash, PowerShell 

• Knowledge of digital forensics including memory and dead-disk examinations of Windows, macOS, and Linux systems 

• Knowledge of security best practices and technologies with an emphasis on current technologies and threats 

• Experience fostering the growth of team members by providing training, guidance, and mentorship to less experienced engineers 

• Experience in creating and maintaining detections within SIEM and/or EDR technologies 

• Experience working in an environment that is certified and compliant with a globally recognized Security Framework / Information Security Management System (NIST SP 800-53, ISO27001, HIPAA, SOX, PCI) 

• Excellent written and verbal communications skills to include presenting to various levels of business and technical leadership. 

• Ability to successfully prioritize, execute, and deliver independently with minimal supervision 

• Strong understanding of the chain of custody process as well as proper physical and digital evidence storage 

• Proven ability to maintain confidentiality and work under short deadlines in stressful situations 

• Strong attention to detail 
   

Desired Qualifications:

• Advanced understanding of cloud security  

• Experience conducting container forensics 

• Splunk certifications 

#LI-Remote