Cyber Security Engineer

Trystar Inc is hiring a Cyber Security Engineer in Burnsville, MN (onsite). In this role, you will lead the design, implementation, monitoring, and continuous improvement of the organization’s cybersecurity program. The position offers deep technical ownership across threat detection, incident response, vulnerability management, identity security, security operations, and cybersecurity architecture, supported by a culture built on safety, integrity, customer focus, teamwork, and continuous improvement.

What you’ll do

• Lead cybersecurity incident detection, investigation, containment, remediation, and recovery activities.
• Act as the primary technical resource during security incidents, including development and maintenance of incident response playbooks and procedures.
• Partner with internal teams, external partners, cyber insurance providers, and forensic teams during investigations.
• Perform threat hunting and root cause analysis, and drive continuous improvements to security monitoring and alerting.
• Own and enhance identity security controls across Microsoft Entra ID and Active Directory, including Conditional Access, MFA, PIM, and FIDO2 passwordless authentication.
• Secure endpoint environments using Microsoft Defender and Intune, and establish identity governance and privileged access standards.
• Collaborate with Digital & IT Teams to implement least-privilege access models.
• Own Microsoft Defender XDR and related security technologies, and monitor and investigate security events across endpoints, identities, email, cloud applications, and infrastructure.
• Develop security dashboards, alerts, and operational reporting, improving security visibility through SIEM and security analytics capabilities.
• Identify emerging threats and implement proactive mitigation strategies.
• Lead the enterprise vulnerability management program, coordinating scanning, remediation, and risk prioritization, and tracking security risks and progress.
• Support third-party penetration testing and security assessments, and design and implement secure architecture across cloud, networking, infrastructure, and business applications.
• Translate evolving legal, regulatory, contractual, customer, cyber insurance, and industry compliance requirements into practical controls, policies, evidence, and remediation plans.
• Lead cybersecurity support for audits and assessments, maintain compliance evidence, identify control gaps, and coordinate remediation with control owners.
• Lead disaster recovery and cyber resilience maturity in partnership with infrastructure, application, business, and site leaders, including recovery strategies, standards, roles, runbooks, dependencies, and recurring recovery exercises.
• Ensure recovery capabilities address cyberattack scenarios such as ransomware, identity compromise, cloud service disruption, and loss of critical infrastructure.
• Work with vendors, managed service providers, consultants, and external partners, and manage ongoing vendor relationships related to performance, deliverables, escalations, and continuous improvement.
• Lead security initiatives within Azure and Microsoft 365, including implementing and maintaining Microsoft Defender for Cloud and Secure Score improvements and cloud security governance controls.
• Support cloud migration initiatives with secure-by-design principles and collaborate with infrastructure teams to build scalable, secure cloud architectures.
• Develop and promote security awareness programs, including phishing simulations and user education.
• Assist with cybersecurity due diligence activities related to acquisitions and integrations.
• Establish security metrics, KPIs, and executive-level reporting, and support ongoing cybersecurity maturity initiatives.

What you bring

• 5+ years of hands-on cybersecurity engineering experience in enterprise environments.
• Experience with Microsoft security technologies including Microsoft Defender, Entra ID, Intune, Sentinel, and Microsoft 365 Security.
• Experience leading or participating in cybersecurity incident response activities.
• Experience implementing identity and access management controls.
• Experience with vulnerability management programs and remediation processes.
• Strong understanding of cybersecurity frameworks, risk management, and defense-in-depth principles.
• Strong knowledge of network security, firewalls, endpoint protection, email security, and cloud security.
• Experience with security monitoring and SIEM platforms.
• Excellent problem solving and analytical skills, with strong communication and documentation abilities.
• Ability to work independently and as part of a team.
• Experience leading or materially improving disaster recovery, cyber resilience, or business continuity capabilities, including recovery planning and exercises.
• Experience aligning cybersecurity controls and programs with evolving regulatory, contractual, customer, or industry compliance requirements.
• Demonstrated experience managing security vendors and managed service providers, including deliverables, escalations, and service performance.

Preferred qualifications

• CISSP, CISM, Security+, SC-200, SC-300, AZ-500, or equivalent security certifications.
• Experience with Microsoft Sentinel and Defender XDR.
• Experience securing Azure environments.
• Experience with manufacturing or operational technology (OT) environments.
• Experience supporting mergers and acquisitions due diligence and integrations.
• Experience with penetration testing remediation and security assessments.
• Experience with FIDO2, passwordless authentication, and Zero Trust initiatives.

Tools and platforms you’ll work with

• Microsoft Defender, Microsoft Defender XDR
• Entra ID, Active Directory, Intune, Microsoft 365 Security
• Microsoft Sentinel, SIEM, security analytics
• Conditional Access, MFA, PIM
• FIDO2 and FIDO2 passwordless authentication
• Microsoft Defender for Cloud, Secure Score
• Azure and Microsoft 365

How Trystar shows up (guiding principles)

• Safety – leave facilities in the same or better condition.
• Integrity – honest, transparent, committed to doing what is right.
• Customer focus – relentless focus on customer success.
• Right with speed – good judgment, thoughtful decisions, and purposeful execution.
• Play for each other – teamwork and support.
• Champion change – adaptation and improvement.
• Enjoy the journey – an environment where appreciation and fun are part of the work.