Compliance Analyst 2 - PCI (Hybrid - Seattle)

This role is offered as hybrid in Seattle, WA. Candidates must be available to work in office at the Nordstrom corporate headquarters a minimum of 4 days/week to be considered for this position. Compliance doesn't have to mean dusty binders and once-a-year fire drills — on this team, it's about building programs that are sharp, current, and built to last. Nordstrom's Governance, Risk & Compliance (GRC) team is looking for a Compliance Analyst to help build out three of our most active programs: the Continuous Compliance Framework (CCF), Financial Control Audit, and PCI DSS. All three are actively maturing, and you'll be right there building alongside us — standing up RACIs, shaping the KPIs/KRIs that show program health, and helping put governance structures in place that actually hold. This isn't a "maintain what already exists" role; it's a "help us build the thing" role. You'll also team up with the rest of the Compliance crew to find smarter, faster ways to get the work done — putting AI and automation to work so evidence collection and control testing stop feeling like a grind and start feeling like a well-oiled machine. This is a great fit for someone who loves getting hands-on: technical control testing, evidence and documentation, RACI and governance design, program metrics — the whole toolkit. You'll work closely with senior analysts across both programs, and as things mature, you'll pick up direct ownership of specific pieces of CCF and/or PCI. Come for the compliance, stay for the team that actually makes it fun. A Day in the Life… Continuous Compliance Framework (CCF) — Build & Support Conduct hands-on testing of CCF controls using established methodologies, and document results clearly so control owners can act on them. Help build out and maintain the CCF module in Nordstrom's GRC tool — control status, testing schedules, evidence records, and ownership assignments. Build and maintain RACIs for CCF controls, working with stakeholders to document clear ownership and accountability. Collect, organize, and validate evidence from control owners, following up on gaps or missing documentation. Partner with the Compliance team to build and test AI-assisted and automated workflows that streamline evidence collection and control testing, validating them on real controls to distinguish genuine time-savers from tasks still needing a human eye. Catch anomalies, exceptions, or gaps that automated evidence pulls or AI-assisted review surface, and loop in senior analysts for follow-up. Support development of basic remediation recommendations for identified control gaps, in partnership with senior analysts. Track remediation activities and status updates to keep the compliance posture current. Support the design of KPIs and KRIs for the CCF program, helping translate testing and remediation data into metrics leadership can use. As you grow in the role, take direct ownership of specific CCF modules or control domains. PCI DSS and Financial Control Audit — Build & Support Conduct hands-on technical control testing for PCI DSS v4.x and Financial Control Audit — firewall rule reviews, access reviews, patch compliance, SDLC, change management, and log configuration checks. PCI DSS scoping, evidence collection, and control testing activities across the annual assessment cycle. Help build and maintain the CDE asset inventory — network segmentation documentation, data flow diagrams, and system component registers. Build and maintain RACIs and governance documentation for the PCI program and Financial Control Audit, clarifying ownership across control owners and stakeholders. Assist with periodic control testing: scheduling, evidence requests, and tracking exceptions through to resolution. Support QSA fieldwork by coordinating document requests and helping prepare evidence packages under senior analyst guidance. Support the design of PCI program KPIs and KRIs and track outcomes over