Cyber Security Engineer – Cloud, Identity & IR Lead

Trystar; Burnsville (MN); On-site; USD 130,000 - 160,000; Full time

Job summary

Trystar is seeking a Cyber Security Engineer in Burnsville, MN to lead the design, implementation, monitoring, and improvement of our cybersecurity program. You will secure cloud, infrastructure, endpoints, identities, and OT environments while enabling business growth and operational excellence.

The role combines hands-on technical security capabilities with risk management, incident response, and security architecture across the organization.

Qualifications

• 5+ years hands-on cybersecurity engineering in enterprise environments.
• Experience with Microsoft security technologies including Defender, Entra ID, Intune, Sentinel, and Microsoft 365 Security.
• Experience leading or participating in cybersecurity incident response.
• Experience implementing identity and access management controls.
• Experience with vulnerability management programs and remediation.
• Strong understanding of cybersecurity frameworks, risk management, and defense-in-depth principles.
• Strong knowledge of network security, firewalls, endpoint protection, email security, and cloud security.
• Experience with security monitoring and SIEM platforms.
• Excellent problem solving and analytical skills.
• Strong communication and documentation abilities.
• Ability to work independently and as part of a team.
• Experience leading disaster recovery, cyber resilience, or business continuity capabilities, including recovery planning and exercises.
• Experience aligning cybersecurity controls with evolving regulatory, contractual, customer, or industry compliance requirements.
• Experience managing security vendors, managed service providers, deliverables, escalations, and service performance.

Responsibilities

• Lead cybersecurity incident detection, investigation, containment, remediation, and recovery activities.
• Serve as the primary technical resource during security incidents.
• Develop and maintain incident response playbooks and procedures.
• Partner with internal stakeholders and external partners during investigations.
• Conduct threat hunting and root cause analysis activities.
• Drive continuous improvements to security monitoring and alerting capabilities.
• Own identity security controls across Microsoft Entra ID and Active Directory environments.
• Lead implementation and management of MFA, PIM, and passwordless authentication.
• Secure endpoint environments through Microsoft Defender and Intune.
• Establish identity governance and privileged access standards.
• Partner with IT teams for least-privilege access models.
• Own Defender XDR and related security technologies.
• Monitor security events across endpoints, identities, email, cloud apps, and infrastructure.
• Develop and maintain security dashboards and reports.
• Improve security visibility via SIEM and analytics.
• Identify threats and implement proactive mitigations.
• Lead enterprise vulnerability management and remediation efforts.
• Coordinate vulnerability scanning and risk prioritization.
• Track and report security risks and remediation progress.
• Collaborate with tech teams to remediate vulnerabilities across all layers.
• Support third party penetration testing and security assessments.
• Design and implement secure cloud, networking, and infrastructure architectures.
• Establish standards, baselines, hardening guidelines, and controls.
• Translate regulatory/commercial requirements into practical controls.
• Lead security audits and remediation tracking.
• Develop DR and cyber resilience plans and exercises.
• Collaborate with vendors and MSPs to meet security objectives.
• Lead cloud security initiatives in Azure and Microsoft 365.
• Support secure-by-design cloud migrations.
• Promote security awareness and training.

Skills

Cybersecurity engineering

Incident response

Communication

Teamwork

Education

CISSP

CISM

Security+

SC-200

SC-300

AZ-500

Tools

Microsoft Defender

Entra ID

Intune

Sentinel

Microsoft 365 Security

Azure

SIEM

Job description

Trystar is seeking a Cyber Security Engineer in Burnsville, MN to lead the design, implementation, monitoring, and improvement of our cybersecurity program. You will secure cloud, infrastructure, endpoints, identities, and OT environments while enabling business growth and operational excellence.

The role combines hands-on technical security capabilities with risk management, incident response, and security architecture across the organization.