Senior Security Engineer - Threat Intelligence & Detection Engineering (Hybrid - Seattle)

Job DescriptionThe Senior Security Engineer on the TIDE team is a hybrid practitioner who writes detection rules, hunts adversary activity across the data lake, and builds the automation that ties it all together. This role requires functional depth in at least two of the following domains: detection engineering, threat intelligence, threat hunting, security automation, investigation analysis, and incident response.This role reports to the Sr. Manager of Threat Intelligence & Detection Engineering and serves as a lead technical contributor on the TIDE team, with independent project horizons of up to 120 days.ResponsibilitiesDetection EngineeringDesign, develop, and maintain high-fidelity detection rules in CrowdStrike NG-SIEM (LogScale/CQL) across endpoint, email, identity, network, and cloud domainsOperationalize the full detection lifecycle: threat modeling, logic development, empirical testing, deployment, tuning, and retirementBuild detection content aligned to MITRE ATT&CK, threat actor TTPs, and internal threat model prioritiesTranslate threat intelligence findings, incident post-mortems, and hunt discoveries into durable detection logicEnforce detection engineering standards including taxonomy, quality criteria, and review processesThreat IntelligenceCollect, analyze, and operationalize tactical and technical threat intelligence from open-source, commercial, and internal sourcesProduce actionable intelligence products including threat actor profiles, TTP summaries, and IOC packages that directly inform detection priorities and hunting hypothesesMonitor threat actor campaigns targeting retail and e-commerce environments across email, endpoint, identity, supply chain, and insider risk vectorsCollaborate with CSIRT and SOC to enrich active investigations with adversary contextApply AI-assisted tooling to accelerate intelligence processing, IOC enrichment, and adversary researchThreat HuntingDesign and execute hypothesis-driven threat hunts across endpoint, email, identity, network, and cloud telemetryApply structured hunting methodologies (MITRE ATT&CK-based, data-driven, indicator-based) to surface undetected adversary activityDocument hunt outcomes—including negative results—and feed confirmed patterns back into the detection libraryMaintain visibility into coverage gaps and drive new hunt-to-detect cycles to close themSOC & Incident Response SupportProvide technical escalation support for complex incidents involving identity compromise, endpoint intrusion, lateral movement, and data exfiltrationConduct targeted forensic and log-based analysis during active investigations, contributing to root cause determination and containment decisionsDevelop and maintain investigation runbooks and analyst guidance to improve SOC response fidelityTranslate post-incident lessons learned into detection and hunting improvementsAutomation and ToolingBuild and maintain automation that accelerates detection deployment, alert triage, case enrichment, and threat intel processingDevelop integrations between SIEM, EDR, email security, SOAR, and threat intelligence platforms to reduce analyst toilApply scripting (Python, PowerShell) to operationalize repetitive workflows including IOC ingest, log parsing, and detection validationLeverage AI and machine learning tools to improve detection quality, reduce false positive rates, and accelerate triageCollaboration and MentorshipMentor less experienced team members through code review, knowledge transfer, and structured guidancePartner with SOC, IAM, Platform Engineering, Email Security, and Cloud teams to ensure telemetry quality and detection coverageContribute to cross-functional initiatives including purple team exercises, tabletop scenarios, and platform migration readinessRequired Qualifications4+ years of professional experience in detection engineering, threat intelligence, SOC/IR, threat hunting, or security automationDemonstrated proficiency writing detection logic in at least one enterprise SIEM or XDR platform; CrowdStrike NG-SIEM (LogScale/CQL) experience strongly preferredWorking knowledge of MITRE ATT&CK at the technique and sub-technique level; ability to map adversary behaviors to telemetry sources and detection logicHands-on experience with EDR analysis, behavioral anomaly detection, and investigation of post-exploitation activityHands-on experience with hypothesis-driven threat hunting; ability to document and execute an end-to-end huntScripting proficiency in Python and/or PowerShell for automation, log parsing, or investigative toolingExperience contributing to incident response for malware incidents, identity-based attacks, or insider threatsStrong written communication skills; ability to produce clear, actionable documentation, detection rationale, and intelligence productsBachelor’s degree in Computer Science, Information Security, or related field, or equivalent professional experiencePreferred QualificationsFamiliarity with identity attack patterns including AiTM, MFA fatigue, session hijacking, token replay, and adversarial abuse of SSO and federated identity platformsExperience with enterprise email security platforms and email-based threat detection including phishing, BEC, and malicious delivery mechanismsExposure to SOAR platforms and workflow automation (CrowdStrike Fusion or equivalent)Experience with threat intelligence platforms (MISP, ThreatConnect, Recorded Future) and structured intel formats (STIX/TAXII)Knowledge of detection-as-code practices, version control (Git), and CI/CD integration for detection deploymentExperience with cloud security telemetry (Azure, AWS) and cloud-native attack detectionDemonstrated use of AI tools to accelerate detection development, security operations, or threat researchIntermediate or advanced certifications such as GIAC GCIA, GCIH, GCTI, GDAT, or equivalentPay Range DetailsThe pay range(s) below has been provided in compliance with state specific laws. Pay ranges may be different for other locations. Pay offers are dependent on the location, as well as job-related knowledge, skills, and experience.$142,000.00 - $220,500.00 AnnualWe’ve got you covered…Our employees are our most important asset and that’s reflected in our benefits. Nordstrom is proud to offer a variety of benefits to support employees and their families, including:Medical/Vision, Dental, Retirement and Paid Time AwayLife Insurance and DisabilityMerchandise Discount and EAP ResourcesThis position may be eligible for performance-based incentives/bonuses. Benefits include 401k, medical/vision/dental/life/disability insurance options, PTO accruals, Holidays, and more. Eligibility requirements may apply based on location, job level, classification, and length of employment. Learn more in the Nordstrom Benefits Overview by copying and pasting the following URL into your browser: few more important points...The job posting highlights the most critical responsibilities and requirements of the job. It’s not all-inclusive. There may be additional duties, responsibilities and qualifications for this job.For Los Angeles or San Francisco applicants: Nordstrom is required to inform you that we conduct background checks after conditional offer and consider qualified applicants with criminal histories in a manner consistent with legal requirements per Los Angeles, Cal. Muni. Code 189.04 and the San Francisco Fair Chance Ordinance. For additional state and location specific notices, please refer to the Legal Notices document within the FAQ section of the Nordstrom Careers site. Applicants with disabilities who require assistance or accommodation should contact the nearest Nordstrom location, which can be identified at . Please be mindful that there may be legal notices and requirements related to this job posting that are specific to your state. Review the Career Site FAQ’s for relevant information and guidelines.Current Nordstrom employees: To apply, log into Workday, click the Careers button and then click Find Jobs.Nordstrom keeps job postings open for at least one day after the posting date. 2026 Nordstrom, IncSummaryLocation: Seattle, WAType: Full time