Trystar’s team members are our most important asset, and we are looking for a highly skilled Cyber Security Engineer to lead the design, implementation, monitoring, and continuous improvement of our cybersecurity program. This role is responsible for securing Trystar’s cloud, infrastructure, endpoint, identity, and operational technology environments while enabling business growth, innovation, and operational excellence.
The ideal candidate combines strong hands-on cybersecurity expertise with strong engineering and risk management capabilities. This role will serve as the technical lead for threat detection, incident response, vulnerability management, identity security, security operations, and cybersecurity architecture across the organization.
We are looking for people who believe in our guiding principles and values of:
Safety – We believe everyone should leave Trystar facilities in the same or better condition than when they arrived.
Integrity – We’re honest, transparent, and committed to doing what’s right.
Customer focus – We have relentless focus on our customers and their success.
Right with speed – We use good judgement, make thoughtful decisions quickly, and execute them with purpose and intensity.
Play for each other – We’re a team. We show up for each other and we know that through teamwork we achieve greatness.
Champion change – We know adaptation and improvement are requirements to survive and to thrive.
Enjoy the journey – We create an environment where our team feels appreciated and has fun along the way.
In this role you will get to
Security Operations & Incident Response
Lead cybersecurity incident detection, investigation, containment, remediation, and recovery activities.
Serve as the primary technical resource during security incidents.
Develop and maintain incident response playbooks and procedures.
Partner with internal stakeholders, external partners, cyber insurance providers, and forensic teams during investigations.
Conduct threat hunting and root cause analysis activities.
Drive continuous improvements to security monitoring and alerting capabilities.
Identity & Endpoint Security
Own and enhance identity security controls across Microsoft Entra ID and Active Directory environments.
Lead implementation and management of Conditional Access, Multifactor Authentication (MFA), Privileged Identity Management (PIM), and FIDO2 passwordless authentication.
Secure endpoint environments through Microsoft Defender and Intune.
Establish identity governance and privileged access standards.
Partner with Digital & IT Teams to implement least-privilege access models.
Security Monitoring & Threat Detection
Own Microsoft Defender XDR and related security technologies.
Monitor and investigate security events across endpoints, identities, email, cloud applications, and infrastructure.
Develop and maintain security dashboards, alerts, and operational reporting.
Improve security visibility through SIEM and security analytics capabilities.
Identify emerging threats and implement proactive mitigation strategies.
Vulnerability & Risk Management
Lead the enterprise vulnerability management program.
Coordinate vulnerability scanning, remediation efforts, and risk prioritization.
Track and report security risks and remediation progress.
Partner with technology teams to remediate infrastructure, cloud, application, and endpoint vulnerabilities.
Support third party penetration testing and security assessments.
Security Architecture & Compliance
Design and implement secure architecture across cloud, networking, infrastructure, and business applications.
Establish security standards, baselines, hardening guidelines, and operational controls.
Evaluate new technologies, vendors, and solutions from a cybersecurity perspective.
Translate evolving legal, regulatory, contractual, customer, cyber insurance, and industry compliance requirements into practical cybersecurity controls, policies, evidence, and remediation plans.
Lead cybersecurity support for audits and assessments, maintain compliance evidence, identify control gaps, and coordinate remediation with control owners.
Disaster Recovery & Cyber Resilience
Lead and mature Trystar’s disaster recovery and cyber resilience program in partnership with infrastructure, application, business, and site leaders.
Establish and maintain recovery strategies, standards, roles, runbooks, system dependencies, and recovery requirements for critical technology services.
Plan, coordinate, and document recurring disaster recovery exercises; track findings and drive corrective actions through completion.
Ensure recovery capabilities address cyberattack scenarios, including ransomware, identity compromise, cloud service disruption, and loss of critical infrastructure.
Security Vendor Management
Work closely with cybersecurity and technology vendors, managed service providers, consultants, and other external partners to achieve security and operational objectives.
Manage ongoing vendor relationships, including service performance, deliverables, escalations, risks, issue resolution, and continuous improvement.
Coordinate vendor security reviews, contract and renewal input, implementation activities, and accountability for remediation commitments.
Partner with internal stakeholders to confirm vendor services remain aligned with Trystar’s cybersecurity strategy, compliance obligations, and business needs.
Cloud Security & Modernization
Lead security initiatives within Azure and Microsoft 365.
Implement and maintain Microsoft Defender for Cloud, Secure Score improvements, and cloud security governance controls.
Support cloud migration initiatives by ensuring secure-by-design principles.
Collaborate with infrastructure teams to develop scalable and secure cloud architectures.
Security Awareness & Strategic Initiatives
Develop and promote security awareness programs throughout the organization.
Conduct phishing simulations and user education activities.
Assist with cybersecurity due diligence activities related to acquisitions and integrations.
Establish security metrics, KPI’s, and executive-level reporting.
Support Trystar’s ongoing cybersecurity maturity initiatives.
Job Requirements
Basic Qualifications
5+ years of hands-on cybersecurity engineering experience in enterprise environments.
Experience with Microsoft security technologies including Microsoft Defender, Entra ID, Intune, Sentinel, and Microsoft 365 Security.
Experience leading or participating in cybersecurity incident response activities.
Experience implementing identity and access management controls.
Experience with vulnerability management programs and remediation processes.
Strong understanding of cybersecurity frameworks, risk management, and defense-in-depth principles.
Strong knowledge of network security, firewalls, endpoint protection, email security, and cloud security.
Experience with security monitoring and SIEM platforms.
Excellent problem solving and analytical skills.
Strong communication and documentation abilities.
Ability to work independently and part of a team.
Experience leading or materially improving disaster recovery, cyber resilience, or business continuity capabilities, including recovery planning and exercises.
Experience aligning cybersecurity controls and programs with evolving regulatory, contractual, customer, or industry compliance requirements.
Demonstrated experience managing security vendors, managed service providers, deliverables, escalations, and service performance.
Preferred Qualifications
CISSP, CISM, Security+, SC-200, SC-300, AZ-500, or equivalent security certifications.
Experience with Microsoft Sentinel and Defender XDR.
Experience securing Azure environments.
Experience with manufacturing or operational technology (OT) environments.
Experience supporting mergers and acquisitions due diligence and integrations.
Experience with penetration testing remediation and security assessments.
Experience with FIDO2, passwordless authentication, and Zero Trust initiatives.
