Cyber Security Engineer — St Paul, MN

Cyber Security Lead Engineer

(Network, Endpoint, Cloud Security & Security Operations)

Position Summary

The Lead Security Engineer provides technical leadership for the design, implementation, administration, and continuous improvement of enterprise security infrastructure and controls across network, endpoint, identity, application, and cloud environments. The role is a senior hands-on technical resource responsible for engineering protective controls, supporting incident response, coordinating vulnerability remediation, and maintaining reliable security platforms. The position establishes technical standards, coordinates security changes, mentors engineers and analysts, and partners with infrastructure, cloud, network, and application teams.

Essential Responsibilities:

Security Engineering and Technical Leadership

• Serve as technical lead across network, endpoint, cloud, and identity security platforms.

• Design, implement, maintain, and optimize security technologies and configuration baselines.

• Lead complex troubleshooting, technical design reviews, security changes, and platform upgrades.

• Establish engineering standards, procedures, documentation, and knowledge-transfer practices.

• Mentor technical staff and evaluate security technologies against operational risks.

Network and Application Security

• Administer Palo Alto Networks and Fortinet firewalls, policies, access rules, and threat logs.

• Configure and tune Cloudflare WAF and coordinate application protection with development teams.

• Support F5 Local Traffic Manager, SSL/TLS certificates, and secure application traffic.

• Coordinate segmentation, secure access, firewall changes, and network troubleshooting.

Endpoint Security and Incident Response

• Lead engineering and administration of CrowdStrike Falcon and Microsoft Defender for Endpoint.

• Maintain EDR policies, sensor health, protection coverage, and operational compliance.

• Investigate endpoint threats, conduct threat hunting, and coordinate containment and remediation.

• Develop incident procedures, response playbooks, and post-incident improvements.

Cloud and Identity Security

• Engineer controls across Azure, Microsoft 365, and applicable AWS environments.

• Administer Entra ID Conditional Access, MFA, PIM, RBAC, and Global Secure Access.

• Support Microsoft Intune device compliance and Microsoft Purview data protection.

• Administer Cisco ISE access policies and investigate authentication and authorization issues.

• Coordinate remediation of cloud misconfigurations and identity-related risks.

Security Monitoring, SIEM, and Automation

• Lead administration and optimization of Microsoft Sentinel and Splunk.

• Maintain security data integrations, connector health, ingestion quality, and monitoring coverage.

• Develop and tune detections, correlation rules, dashboards, and KQL investigations.

• Automate workflows using Logic Apps, PowerShell, Python, Git, and Azure DevOps.

• Align detection engineering with MITRE ATT&CK and produce operational metrics.

Vulnerability and Exposure Management

• Coordinate enterprise vulnerability remediation using Qualys, Nessus, and Defender EASM.

• Prioritize findings by exploitability, exposure, severity, and business impact.

• Work with technical owners on remediation plans, compensating controls, and verification.

• Track high-risk issues, escalate overdue remediation, and support hardening and patching.

Operational Coordination and Continuous Improvement

• Coordinate security engineering work across infrastructure, networking, cloud, and application teams.

• Maintain runbooks, change records, configuration documentation, and audit evidence.

• Track work through Jira, ServiceNow, or comparable tools.

• Improve engineering efficiency, service reliability, resilience, and cross-training.

Qualifications (minimal)

• Candidate must pass CJIS Level 4 Certification with supported FBI Background Check.

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field; equivalent combinations of education and experience may be considered.

• Five or more years of progressive experience in cybersecurity engineering, security operations, or enterprise infrastructure security.

• Demonstrated hands-on experience with enterprise security platforms and cross-functional technical leadership.

• Knowledge of firewalls, EDR, cloud identity, incident response, vulnerability management, SIEM, automation, and change management.

• Strong analytical, troubleshooting, documentation, and communication skills.

Qualifications (optional)

• Master’s degree in a related field and seven or more years of relevant experience.

• Experience with Palo Alto Networks, CrowdStrike Falcon, Cloudflare WAF, Cisco ISE, Microsoft Sentinel, and Defender XDR.

• Experience with Entra Conditional Access, PIM, Intune, KQL, PowerShell, Python, Logic Apps, Git, and Azure DevOps.

• Familiarity with NIST CSF, CIS Controls, MITRE ATT&CK, and regulated or public-sector environments.

Certifications (minimal)

• CompTIA Security+ or CySA+; GIAC GMON or comparable GIAC credential.

• Microsoft Azure Administrator or security engineering certifications.

• Palo Alto Networks, AWS, Qualys, CISSP, or comparable security certifications.