IS Security Engineer

Menards Inc.; Town of Union (WI); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Profit Sharing

401k

Paid Vacation

Team Member Discount

Collaborative environment

Mon-Fri work week

Job summary

Menards Inc. in Eau Claire, WI seeks a Security Engineer to develop, implement, and validate security controls protecting team member and guest information.

Responsibilities focus on vulnerability management and security automation, or offensive security testing and control validation. Candidates should have practical experience in either vulnerability management and automation or offensive security, with foundational knowledge across related disciplines and a willingness to broaden skills.

Qualifications

• Bachelor’s degree in a related field and 3+ years of security experience.
• Practical experience in vulnerability management, security automation, or app security.
• Proficient in Python for security automation and tooling.

Responsibilities

• Vulnerability management: assess, validate findings, prioritize remediation and verify remediation.
• Security automation: build Python tools and API integrations to automate workflows and reporting.
• Offensive security and control validation: perform authorized tests and document gaps.
• Risk assessment: analyze risks in systems, apps, cloud, and third parties.
• Application security: integrate secure practices into CI/CD pipelines.
• Cloud security: assess configurations and recommend improvements.

Skills

Python

Analytical skills

Verbal communication

Written communication

Collaboration

Education

Bachelor's degree in Cybersecurity, Computer Science, MIS or related field

Tools

Qualys

Nessus

Nexpose

Veracode

Sonatype Lifecycle

Job description

Why Work for Menards?

• Profit Sharing & 401k, Paid Vacation & Holidays
• Team Member Discount
• Highly collaborative work environment
• Monday – Friday work week
• On campus coffee shop/cafeteria with live music!
• Pay based on experience

POSITION SUMMARY:

The Security Engineer develops, implements, and validates security controls that protect Menards Team Member and Guest information. Responsibilities focus primarily on either vulnerability management and security automation, or offensive security testing and control validation. Engineers also contribute to risk assessment, application security, and other security initiatives.

Candidates should bring practical experience in either vulnerability management and security automation, or offensive security and control validation. Expertise in both areas is not required, but candidates should possess foundational knowledge of related security disciplines and a willingness to broaden their skills.

Security Engineers collaborate with development and infrastructure teams to identify risks, improve defenses, and verify remediation. This position requires a highly motivated, team-oriented person with strong communication skills.

PRIMARY RESPONSIBILITIES:

• Vulnerability management:Assess systems and applications for vulnerabilities, validate findings, and prioritize remediation based on exploitability, exposure, and business impact. Develop reporting and analysis to support remediation efforts and verify remediation.
• Security automation:Develop and maintain Python scripts, tools, and API integrations to analyze security data, automate workflows, and produce actionable reports, using appropriate documentation, version control, and testing.
• Offensive security and control validation:Conduct authorized web application and infrastructure penetration tests, red-team exercises, purple-team assessments, or technical control tests, as assigned, to evaluate defenses, document gaps, and verify remediation.
• Risk assessment:Assess risks in systems, applications, cloud services, and third parties, document findings, and recommend controls or treatment options.
• Application security:Serve as a resource to application development teams to integrate secure development practices and testing into continuous integration and continuous delivery/deployment (CI/CD) pipelines.
• Cloud security:Work with infrastructure and development teams to assess cloud security configurations, identify risks, and recommend appropriate security improvements.

REQUIRED QUALIFICATIONS:

• Bachelor's degree in Cybersecurity, Computer Science, Management Information Systems, or a related field.
• At least three years of professional experience in information security or a closely related technical role.
• At least one practitioner-level security certification, such as CompTIA Cybersecurity Analyst (CySA+), CompTIA PenTest+, ISC2 Systems Security Certified Practitioner (SSCP), or GIAC Security Essentials (GSEC), or equivalent demonstrated technical experience.
• Practical experience in vulnerability management, security automation, application security, security operations, or offensive security.
• Proficiency in Python to develop, troubleshoot, and maintain scripts and tools supporting security automation activities.
• Working knowledge of application security, operating systems, networking, identity and access controls, and vulnerability assessment.
• Foundational knowledge of cloud environments (shared responsibility, access controls, networking, and logging) and CI/CD pipelines (security testing, permissions, and secrets management).
• Strong analytical, verbal and written communication, and collaboration skills to evaluate findings, identify root causes, explain risk, and recommend remediation to system and application owners.
• Demonstrated ability to coordinate cross-functional efforts, facilitate technical discussions, and drive security improvements through collaboration and effective communication.
• Demonstrated ability to work independently, solve technical problems, prioritize competing needs, and manage multiple tasks.

PREFERRED QUALIFICATIONS:

• Experience with vulnerability assessment and application security tools such as Qualys, Nessus, Nexpose, Veracode, or Sonatype Lifecycle.
• Demonstrated experience with application security testing, dependency analysis, or CI/CD security integration.
• Experience with security monitoring, detection engineering, or related security technologies such as SIEM, EDR, and XDR solutions.
• Hands-on experience conducting web application or infrastructure penetration tests, purple-team exercises, or technical security control assessments.
• Advanced Python skills, including API integrations, automated testing, and development of maintainable security tools.
• Experience applying the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to security assessments or improvement initiatives.
• Advanced security certifications, such as ISC2 Certified Information Systems Security Professional (CISSP), GIAC Penetration Tester (GPEN), OffSec Certified Professional (OSCP), Hack The Box Certified Penetration Testing Specialist (CPTS), or comparable certifications.

WORK SCHEDULE AND ELIGIBILITY:

• Must work during designated normal office hours. Occasional overtime and on-call support may be required.
• This position is located on-site in Eau Claire, WI and requires relocation to the area. Remote or hybrid work is not available.
• Candidates must be eligible to work in the United States without sponsorshiP.