Compliance Analyst - PCI; Hybrid - Seattle

Job Description

This role is offered as hybrid in Seattle, WA. Candidates must be available to work in office at the Nordstrom corporate headquarters a minimum of 4 days/week to be considered for this position.

Compliance doesn't have to mean dusty binders and once-a-year fire drills — on this team, it's about building programs that are sharp, current, and built to last. Nordstrom's Governance, Risk & Compliance (GRC) team is looking for a Compliance Analyst to help build out three of our most active programs: the Continuous Compliance Framework (CCF), Financial Control Audit, and PCI DSS.

All three are actively maturing, and you'll be right there building alongside us — standing up RACIs, shaping the KPIs/KRIs that show program health, and helping put governance structures in place that actually hold. This isn't a "maintain what already exists" role; it's a "help us build the thing" role.

You'll also team up with the rest of the Compliance crew to find smarter, faster ways to get the work done — putting AI and automation to work so evidence collection and control testing stop feeling like a grind and start feeling like a well‑oiled machine.

This is a great fit for someone who loves getting hands‑on: technical control testing, evidence and documentation, RACI and governance design, program metrics — the whole toolkit. You'll work closely with senior analysts across both programs, and as things mature, you'll pick up direct ownership of specific pieces of CCF and/or PCI.

Come for the compliance, stay for the team that actually makes it fun.

• Conduct hands‑on testing of CCF controls using established methodologies, and document results clearly so control owners can act on them.
• Help build out and maintain the CCF module in Nordstrom's GRC tool — control status, testing schedules, evidence records, and ownership assignments.
• Build and maintain RACIs for CCF controls, working with stakeholders to document clear ownership and accountability.
• Collect, organize, and validate evidence from control owners, following up on gaps or missing documentation.
• Partner with the Compliance team to build and test AI‑assisted and automated workflows that streamline evidence collection and control testing, validating them on real controls to distinguish genuine time‑sav​ers from tasks still needing a human eye.
• Catch anomalies, exceptions, or gaps that automated evidence pulls or AI‑assisted review surface, and loop in senior analysts for follow‑up.
• Support development of basic remediation recommendations for identified control gaps, in partnership with senior analysts.
• Track remediation activities and status updates to keep the compliance posture current.
• Support the design of KPIs and KRIs for the CCF program, helping translate testing and remediation data into metrics leadership can use.
• As you grow in the role, take direct ownership of specific CCF modules or control domains.

• Conduct hands‑on technical control testing for PCI DSS v4.x and Financial Control Audit — firewall rule reviews, access reviews, patch compliance, SDLC, change management, and log configuration checks.
• PCI DSS scoping, evidence collection, and control testing activities across the annual assessment cycle.
• Help build and maintain the CDE asset inventory — network segmentation documentation, data flow diagrams, and system component registers.
• Build and maintain RACIs and governance documentation for the PCI program and Financial Control Audit, clarifying ownership across control owners and stakeholders.
• Assist with periodic control testing: scheduling, evidence requests, and tracking exceptions through to resolution.
• Support…