IS Security Engineer

Menard, Inc•Eau Claire, WI

1d•Onsite

About The Position

The Security Engineer develops, implements, and validates security controls that protect Menards Team Member and Guest information. Responsibilities focus primarily on either vulnerability management and security automation, or offensive security testing and control validation. Engineers also contribute to risk assessment, application security, and other security initiatives. Candidates should bring practical experience in either vulnerability management and security automation, or offensive security and control validation. Expertise in both areas is not required, but candidates should possess foundational knowledge of related security disciplines and a willingness to broaden their skills. Security Engineers collaborate with development and infrastructure teams to identify risks, improve defenses, and verify remediation. This position requires a highly motivated, team-oriented person with strong communication skills.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Management Information Systems, or a related field.
At least three years of professional experience in information security or a closely related technical role.
At least one practitioner-level security certification, such as CompTIA Cybersecurity Analyst (CySA+), CompTIA PenTest+, ISC2 Systems Security Certified Practitioner (SSCP), or GIAC Security Essentials (GSEC), or equivalent demonstrated technical experience.
Practical experience in vulnerability management, security automation, application security, security operations, or offensive security.
Proficiency in Python to develop, troubleshoot, and maintain scripts and tools supporting security automation activities.
Working knowledge of application security, operating systems, networking, identity and access controls, and vulnerability assessment.
Foundational knowledge of cloud environments (shared responsibility, access controls, networking, and logging) and CI/CD pipelines (security testing, permissions, and secrets management).
Strong analytical, verbal and written communication, and collaboration skills to evaluate findings, identify root causes, explain risk, and recommend remediation to system and application owners.
Demonstrated ability to coordinate cross-functional efforts, facilitate technical discussions, and drive security improvements through collaboration and effective communication.
Demonstrated ability to work independently, solve technical problems, prioritize competing needs, and manage multiple tasks.

Nice To Haves

Experience with vulnerability assessment and application security tools such as Qualys, Nessus, Nexpose, Veracode, or Sonatype Lifecycle.
Demonstrated experience with application security testing, dependency analysis, or CI/CD security integration.
Experience with security monitoring, detection engineering, or related security technologies such as SIEM, EDR, and XDR solutions.
Hands-on experience conducting web application or infrastructure penetration tests, purple-team exercises, or technical security control assessments.
Advanced Python skills, including API integrations, automated testing, and development of maintainable security tools.
Experience applying the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to security assessments or improvement initiatives.
Advanced security certifications, such as ISC2 Certified Information Systems Security Professional (CISSP), GIAC Penetration Tester (GPEN), OffSec Certified Professional (OSCP), Hack The Box Certified Penetration Testing Specialist (CPTS), or comparable certifications.

Responsibilities

Vulnerability management: Assess systems and applications for vulnerabilities, validate findings, and prioritize remediation based on exploitability, exposure, and business impact. Develop reporting and analysis to support remediation efforts and verify remediation.
Security automation: Develop and maintain Python scripts, tools, and API integrations to analyze security data, automate workflows, and produce actionable reports, using appropriate documentation, version control, and testing.
Offensive security and control validation: Conduct authorized web application and infrastructure penetration tests, red-team exercises, purple-team assessments, or technical control tests, as assigned, to evaluate defenses, document gaps, and verify remediation.
Risk assessment: Assess risks in systems, applications, cloud services, and third parties, document findings, and recommend controls or treatment options.
Application security: Serve as a resource to application development teams to integrate secure development practices and testing into continuous integration and continuous delivery/deployment (CI/CD) pipelines.
Cloud security: Work with infrastructure and development teams to assess cloud security configurations, identify risks, and recommend appropriate security improvements.