Cyber Security Engineer

Trystar Inc is seeking a Cyber Security Engineer in Burnsville, MN to help lead the design, implementation, monitoring, and continuous improvement of its cybersecurity program. This onsite role offers technical leadership across threat detection, incident response, vulnerability management, identity security, security operations, and cybersecurity architecture, with clear ownership of key security platforms and enterprise programs.

Responsibilities

• Lead cybersecurity incident detection, investigation, containment, remediation, and recovery activities.
• Act as the primary technical resource during security incidents.
• Develop and maintain incident response playbooks and procedures.
• Partner with internal stakeholders, external partners, cyber insurance providers, and forensic teams during investigations.
• Conduct threat hunting and root cause analysis activities.
• Drive continuous improvements to security monitoring and alerting capabilities.
• Own and enhance identity security controls across Microsoft Entra ID and Active Directory.
• Lead implementation and management of Conditional Access, Multifactor Authentication (MFA), Privileged Identity Management (PIM), and FIDO2 passwordless authentication.
• Secure endpoint environments through Microsoft Defender and Intune.
• Establish identity governance and privileged access standards.
• Partner with Digital and IT Teams to implement least-privilege access models.
• Own Microsoft Defender XDR and related security technologies.
• Monitor and investigate security events across endpoints, identities, email, cloud applications, and infrastructure.
• Develop and maintain security dashboards, alerts, and operational reporting.
• Improve security visibility through SIEM and security analytics capabilities.
• Identify emerging threats and implement proactive mitigation strategies.
• Lead the enterprise vulnerability management program, coordinating scanning, remediation, and risk prioritization.
• Track and report security risks and remediation progress, coordinating remediation with technology teams.
• Support third party penetration testing and security assessments.
• Design and implement secure architecture across cloud, networking, infrastructure, and business applications.
• Establish security standards, baselines, hardening guidelines, and operational controls.
• Evaluate new technologies, vendors, and solutions from a cybersecurity perspective.
• Translate evolving legal, regulatory, contractual, customer, cyber insurance, and industry compliance requirements into practical cybersecurity controls, policies, evidence, and remediation plans.
• Lead cybersecurity support for audits and assessments, maintaining compliance evidence, identifying control gaps, and coordinating remediation.
• Lead and mature disaster recovery and cyber resilience in partnership with infrastructure, application, business, and site leaders, including recovery strategies, standards, roles, runbooks, dependencies, and recovery requirements.
• Plan, coordinate, and document recurring disaster recovery exercises, track findings, and drive corrective actions to completion.
• Ensure recovery capabilities address cyberattack scenarios including ransomware, identity compromise, cloud service disruption, and loss of critical infrastructure.
• Support security initiatives within Azure and Microsoft 365, including Microsoft Defender for Cloud and Secure Score improvements.
• Collaborate with infrastructure teams to develop scalable and secure cloud architectures and support secure-by-design principles during cloud migration.
• Develop and promote security awareness programs, including phishing simulations and user education activities.
• Assist with cybersecurity due diligence for acquisitions and integrations.
• Establish security metrics, KPIs, and executive-level reporting, and support ongoing cybersecurity maturity initiatives.
• Work with vendors, managed service providers, consultants, and external partners, including managing deliverables, escalations, service performance, risks, and continuous improvement.
• Coordinate vendor security reviews and provide contract and renewal input related to remediation commitments.

Requirements

• 5+ years of hands-on cybersecurity engineering experience in enterprise environments.
• Experience with Microsoft security technologies including Microsoft Defender, Entra ID, Intune, Sentinel, and Microsoft 365 Security.
• Experience leading or participating in cybersecurity incident response activities.
• Experience implementing identity and access management controls.
• Experience with vulnerability management programs and remediation processes.
• Strong understanding of cybersecurity frameworks, risk management, and defense-in-depth principles.
• Strong knowledge of network security, firewalls, endpoint protection, email security, and cloud security.
• Experience with security monitoring and SIEM platforms.
• Excellent problem-solving and analytical skills.
• Strong communication and documentation abilities.
• Ability to work independently and as part of a team.
• Experience leading or materially improving disaster recovery, cyber resilience, or business continuity capabilities, including recovery planning and exercises.
• Experience aligning cybersecurity controls and programs with evolving regulatory, contractual, customer, or industry compliance requirements.
• Demonstrated experience managing security vendors and managed service providers, including deliverables, escalations, and service performance.

Technologies

• Microsoft Defender, Entra ID, Intune, Sentinel, Microsoft 365 Security
• Conditional Access, Multifactor Authentication (MFA), Privileged Identity Management (PIM), FIDO2
• Microsoft Defender XDR
• SIEM and security analytics
• Microsoft Defender for Cloud, Secure Score
• Azure, Microsoft 365, Active Directory
• FIDO2 passwordless authentication

Preferred qualifications

• CISSP, CISM, Security+, SC-200, SC-300, AZ-500, or equivalent security certifications.
• Experience with Microsoft Sentinel and Defender XDR.
• Experience securing Azure environments.
• Experience with manufacturing or operational technology (OT) environments.
• Experience supporting mergers and acquisitions due diligence and integrations.
• Experience with penetration testing remediation and security assessments.
• Experience with FIDO2, passwordless authentication, and Zero Trust initiatives.

Company values

• Safety – everyone leaves Trystar facilities in the same or better condition than when they arrived.
• Integrity – honest, transparent, and committed to doing what is right.
• Customer focus – relentless focus on customers and their success.
• Right with speed – good judgement, thoughtful decisions quickly, purposeful execution.
• Play for each other – teamwork and showing up for one another.
• Champion change – adaptation and improvement as requirements to survive and thrive.
• Enjoy the journey – an environment where teams feel appreciated and have fun along the way.