Sr Principal Technical Program Manager - Cybersecurity (Hybrid - Seattle)

We are seeking a Technical Program Manager, Principal Sr. to lead the delivery of Nordstrom’s highest-impact cybersecurity programs — initiatives that protect the company’s customers, data, and operations across every technology and business function. This senior-most individual contributor role sits within the CISO’s organization, at the intersection of security engineering, governance risk and compliance (GRC), and enterprise technology delivery. You will drive the programs that reduce Nordstrom’s risk posture at scale — partnering with security, platform, and business teams to plan, sequence, and execute complex, cross-functional security initiatives from charter through measurable outcome. This is not a role for managing programs at arm’s length. It is a role for someone who translates security strategy into executable delivery plans, manages risk and dependencies across a portfolio of concurrent programs, holds partners accountable to commitments, and reports progress with rigor to senior leadership. You will operate with SVP/VP-level visibility and represent program delivery excellence for Nordstrom’s cybersecurity organization.

Program Strategy & Portfolio Leadership Own end-to-end delivery for a portfolio of enterprise cybersecurity programs (e.g., identity and access management, cloud security, data protection, incident response, vulnerability management, third-party risk) spanning multiple teams and technology domains. Translate security strategy and executive priorities into structured program charters, roadmaps, and delivery plans with clear scope, milestones, and success criteria. Sequence and prioritize competing initiatives across the security portfolio based on risk reduction, business impact, and resource constraints. Partner with the CISO’s leadership team to shape investment priorities and build/partner/buy decisions for major security initiatives. Program Governance & Risk Management Establish and run program governance — steering committees, checkpoints, and decision forums — that keep security programs on track and escalate issues before they become blockers. Identify, track, and drive resolution of program risks, issues, and dependencies across security, engineering, legal, and business stakeholders. Ensure programs comply with relevant regulatory, audit, and internal control requirements, partnering with GRC and compliance teams as needed. Define and enforce delivery standards and program management best practices across the cybersecurity organization. Cross-Functional Delivery & Stakeholder Alignment Build and lead cross-functional program teams spanning security engineering, IT, platform, legal, privacy, and business units to execute enterprise-wide security initiatives. Drive alignment among stakeholders with competing priorities, resolving conflicts and unblocking delivery through structured negotiation and clear articulation of tradeoffs. Serve as the primary point of coordination between the cybersecurity organization and business/technology teams impacted by security programs, ensuring changes roll out with minimal disruption. Partner with vendors and external partners supporting security program delivery, managing scope, timeline, and contractual commitments. Metrics, Reporting & Executive Communication Define program-level metrics and KPIs that demonstrate risk reduction, delivery velocity, and program health across the security portfolio. Build and maintain dashboards and status reporting that give practitioners and senior leadership real-time visibility into program progress and risk. Report program status, risks, and impact to VP/SVP-level and executive stakeholders with clarity, rigor, and actionable recommendations. Use data and post-program retrospectives to continuously improve program delivery practices across the organization.

Leadership & Mentorship Mentor and develop TPMs and program managers across the cybersecurity