IT Security Engineer

Trek•Waterloo, WI

2d•Hybrid

About The Position

Trek is seeking an Information Security Engineer to join its global cybersecurity team. This role is responsible for Identity & Access Management (IAM) and Security Operations (SOC), protecting Trek's systems against intrusions. The engineer will be the hands-on owner of identity infrastructure, including Microsoft Entra ID, privileged access, and joiner-mover-leaver processes. They will also act as the primary security analyst, monitoring threats, investigating incidents, and managing detection and response workflows using tools like CrowdStrike Falcon, Zscaler, and Microsoft Sentinel. This senior individual contributor role requires both IAM engineering precision and SOC analyst instincts, with close collaboration with the Director of IT Security and cross-functional teams. The position offers a dynamic environment where the work directly protects a globally recognized brand.

Requirements

5+ years' experience in IT or information security, with demonstrable hands-on ownership across both IAM and security operations functions
Deep hands-on experience with Microsoft Entra ID (Azure AD) including SSO, MFA, Conditional Access, and directory operations
Strong understanding of IAM concepts: RBAC, least privilege, PAM, JML processes, access certification, and federated identity
Experience with endpoint detection and response (EDR) platforms — CrowdStrike Falcon strongly preferred
Experience with SIEM platforms for alert monitoring, investigation, and detection rule management — Microsoft Sentinel preferred
Experience with network security monitoring and proxy platforms — Zscaler ZIA/ZPA preferred
Demonstrated ability to own incident response end-to-end: triage, investigation, containment, eradication, and documentation
Strong understanding of Windows and nix systems, network architecture and protocols (TCP/IP, DNS, HTTPS), and cloud technologies
Demonstrated ability to incorporate AI tools into security workflows — not just awareness of them
Excellent written and verbal communication skills — able to explain identity risk and security incidents to non-technical stakeholders
Holds or is actively pursuing relevant certification: (ISC)² CISSP/CCSP/SSCP; SANS GIAC GCIH/GCIA/GCFA; Microsoft SC-300; CompTIA Security+; or equivalent

Nice To Haves

Experience with privileged access management platforms (CyberArk, BeyondTrust, Admin by Request, or similar)
Scripting experience — PowerShell or Python — for automating identity workflows, detection pipelines, and security integrations
Experience with physical security systems (access control, CCTV) as a secondary function
Experience supporting compliance frameworks — PCI DSS, ISO 27001, SOC 2, or similar — with technical evidence and control documentation
Experience with threat hunting methodologies and hypothesis-driven investigation
Bachelor's degree in Computer Science, Information Security, MIS, or equivalent experience

Responsibilities

Own the IAM program lifecycle: identity governance, role-based access control (RBAC), access certification, joiner-mover-leaver (JML) processes, and policy enforcement
Administer and optimize Microsoft Entra ID (Azure AD) including SSO, MFA, Conditional Access policies, and directory health
Design and maintain a least-privilege access model across SaaS, cloud, and on-premises systems, including privileged access management (PAM)
Drive access certification campaigns: scope, execute, and report on periodic entitlement reviews across all systems
Develop and enforce IAM policies, standards, and procedures — including third-party and service account governance
Detect and investigate identity-based threats: anomalous authentication, lateral movement indicators, credential abuse, and over-privileged account activity
Partner with HR, IT, and application teams to ensure processes are accurate, automated where possible, and consistently enforced
Support audit and compliance activities with identity evidence and access control documentation
Serve as Trek's primary security analyst: monitor alerts across CrowdStrike Falcon, Microsoft Sentinel, and Zscaler; triage, investigate, and escalate as warranted
Own the incident response lifecycle for security events — from initial detection through containment, eradication, recovery, and post-incident review
Develop, tune, and maintain detection rules and correlation logic across SIEM and EDR platforms to reduce noise and surface high-confidence detections
Build and maintain incident response playbooks, investigation runbooks, and post-incident documentation
Integrate identity signals and IAM data into SOC detection workflows — connecting the IAM and SOC functions into a unified threat detection capability
Conduct threat hunting using CrowdStrike, Sentinel, and Zscaler telemetry to proactively identify attacker activity that evades automated detection
Orchestrate and automate security operations workflows to improve speed and consistency across the security team
Evangelize information security practices within Trek worldwide
Perform other duties as assigned
Using AI to analyze access patterns and entitlement data at scale — identifying over-provisioning, dormant accounts, anomalous permission combinations, and least-privilege violations across large user populations
Applying AI to accelerate alert triage, reduce noise, and surface high-confidence detections across SIEM and EDR platforms
Leveraging AI to enrich threat intelligence, correlate indicators of compromise (IOCs), and contextualize threats against Trek's environment
Using AI to draft and refine IAM policies, role definitions, access request templates, incident response playbooks, and governance documentation
Employing AI coding assistants to automate JML workflows, build security integrations, and maintain detection and reporting pipelines
Continuously evaluating new AI-driven security capabilities and recommending adoption where they meaningfully reduce risk or analyst toil