IS Security Engineer

Menards is seeking an IS Security Engineer to help protect Team Member and Guest information through the development, implementation, and validation of security controls. This on-site role in Eau Claire, WI emphasizes vulnerability management and security automation, as well as offensive security testing and technical control validation, depending on assigned focus.

What you’ll do

• Assess systems and applications for vulnerabilities, validate findings, and prioritize remediation based on exploitability, exposure, and business impact.
• Build reporting and analysis that support remediation efforts and verify remediation progress.
• Develop and maintain Python scripts, tools, and API integrations to analyze security data, automate workflows, and generate actionable reports, with appropriate documentation, version control, and testing.
• Perform authorized web application and infrastructure penetration tests, red-team activities, purple-team assessments, or other technical control tests as assigned to evaluate defenses, document gaps, and verify remediation.
• Assess risks across systems, applications, cloud services, and third parties, document findings, and recommend controls or treatment options.
• Support application development teams by integrating secure development practices and testing into CI/CD pipelines.
• Partner with infrastructure and development teams to evaluate cloud security configurations, identify risks, and recommend security improvements.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Management Information Systems, or a related field.
• At least 3 years of professional experience in information security or a closely related technical role.
• At least one practitioner-level security certification such as CompTIA CySA+, CompTIA PenTest+, ISC2 SSCP, or GIAC GSEC, or equivalent demonstrated technical experience.
• Practical experience in vulnerability management, security automation, application security, security operations, or offensive security.
• Proficiency in Python to develop, troubleshoot, and maintain scripts and tools for security automation.
• Working knowledge of application security, operating systems, networking, identity and access controls, and vulnerability assessment.
• Foundational knowledge of cloud environments (shared responsibility, access controls, networking, and logging) and CI/CD pipelines (security testing, permissions, and secrets management).
• Strong analytical skills and clear verbal and written communication to evaluate findings, explain risk, identify root causes, and recommend remediation.
• Ability to coordinate cross-functional efforts, facilitate technical discussions, and drive security improvements collaboratively.
• Ability to work independently, solve technical problems, prioritize competing needs, and manage multiple tasks.

Technologies you may work with

• Python
• CompTIA Cybersecurity Analyst (CySA+), CompTIA PenTest+, ISC2 SSCP, GIAC Security Essentials (GSEC)
• Qualys, Nessus, Nexpose, Veracode, Sonatype Lifecycle
• SIEM, EDR, XDR
• NIST CSF
• ISC2 CISSP, GIAC Penetration Tester (GPEN), OffSec Certified Professional (OSCP), Hack The Box Certified Penetration Testing Specialist (CPTS)

Benefits

• Profit Sharing & 401k
• Paid Vacation & Holidays
• Team Member Discount
• Highly collaborative work environment
• Monday – Friday work week
• On campus coffee shop/cafeteria with live music!
• Pay based on experience

Schedule and eligibility

• Must work during designated normal office hours; occasional overtime and on-call support may be required.
• On-site in Eau Claire, WI with relocation to the area required; remote or hybrid work is not available.
• Candidates must be eligible to work in the United States without sponsorship.

Security Engineers at Menards collaborate with development and infrastructure teams to identify risks, improve defenses, and verify remediation. The role is well-suited to a motivated, team-oriented professional with strong communication skills and practical experience in either vulnerability management and security automation, or offensive security and control validation.