IS Security Engineer

The Security Engineer designs, implements, and validates security controls to protect Menards Team Member and Guest information. The focus of the role centers on either vulnerability management and security automation or offensive security testing and control validation, with additional contributions to risk assessment and application security initiatives.

Onsite Location and Work Setup

This position is onsite in Eau Claire, WI and requires relocation to the area. Remote or hybrid work is not available. The role requires work during designated normal office hours, with occasional overtime and on-call support potentially required. Candidates must be eligible to work in the United States without sponsorship.

Core Responsibilities

• Assess systems and applications for vulnerabilities, validate findings, and prioritize remediation based on exploitability, exposure, and business impact.
• Develop reporting and analysis that support remediation efforts and verify that remediation is effective.
• Write and maintain Python scripts, tools, and API integrations to analyze security data, automate workflows, and produce actionable reporting, with appropriate documentation, version control, and testing.
• Perform authorized web application and infrastructure penetration tests, red-team exercises, purple-team assessments, or technical control testing as assigned to evaluate defenses, document gaps, and verify remediation.
• Assess risks across systems, applications, cloud services, and third parties, document findings, and recommend controls or treatment options.
• Support application development teams by integrating secure development practices and testing into CI/CD pipelines.
• Partner with infrastructure and development teams to review cloud security configurations, identify risks, and recommend security improvements.

Minimum Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Management Information Systems, or a related field.
• At least 3 years of professional experience in information security or a closely related technical role.
• At least one practitioner-level security certification, such as CompTIA CySA+, CompTIA PenTest+, ISC2 SSCP, or GIAC GSEC, or equivalent demonstrated technical experience.
• Practical experience in vulnerability management, security automation, application security, security operations, or offensive security.
• Proficiency in Python to develop, troubleshoot, and maintain scripts and tools supporting security automation activities.
• Working knowledge of application security, operating systems, networking, identity and access controls, and vulnerability assessment.
• Foundational knowledge of cloud environments (shared responsibility, access controls, networking, and logging) and CI/CD pipelines (security testing, permissions, and secrets management).
• Strong analytical skills and effective verbal and written communication for evaluating findings, explaining risk, and recommending remediation to system and application owners.
• Ability to coordinate cross-functional efforts, facilitate technical discussions, and drive security improvements through collaboration.
• Ability to work independently, solve technical problems, prioritize competing needs, and manage multiple tasks.

Technologies and Tools

Python; CompTIA Cybersecurity Analyst (CySA+); CompTIA PenTest+; ISC2 Systems Security Certified Practitioner (SSCP); GIAC Security Essentials (GSEC); Qualys; Nessus; Nexpose; Veracode; Sonatype Lifecycle; SIEM; EDR; XDR; NIST CSF; ISC2 Certified Information Systems Security Professional (CISSP); GIAC Penetration Tester (GPEN); OffSec Certified Professional (OSCP); Hack The Box Certified Penetration Testing Specialist (CPTS).

Preferred Qualifications

• Experience with vulnerability assessment and application security tools such as Qualys, Nessus, Nexpose, Veracode, or Sonatype Lifecycle.
• Demonstrated experience with application security testing, dependency analysis, or CI/CD security integration.
• Experience with security monitoring, detection engineering, or related security technologies such as SIEM, EDR, and XDR.
• Hands-on experience conducting web application or infrastructure penetration tests, purple-team exercises, or technical security control assessments.
• Advanced Python skills, including API integrations, automated testing, and development of maintainable security tools.
• Experience applying NIST CSF to security assessments or improvement initiatives.
• Advanced security certifications such as ISC2 CISSP, GIAC GPEN, OffSec OSCP, Hack The Box CPTS, or comparable certifications.

Benefits

• Profit Sharing & 401k
• Paid Vacation & Holidays
• Team Member Discount
• Highly collaborative work environment
• Monday – Friday work week
• On campus coffee shop/cafeteria with live music!
• Pay based on experience