Open Minneapolis / St. Paul Cybersecurity jobs

Summary

A principal cybersecurity analyst role at Optum and UnitedHealth specializing in asset discovery and intelligence, operating enterprise asset-intelligence platforms (ARMIS) to support asset visibility, classification, and data quality across large networks. It is a remote, networking-grounded seat focused on knowing what is on the network rather than incident response.

Summary

An AI Red Team Operator role at Optum and UnitedHealth Group, designing and delivering realistic adversarial cyberattacks to test and improve the company's detection and response. It is remote within the U.S., though Minneapolis or Washington, D.C. hires must be in-office four days a week; a hands-on offensive-security seat with an AI and adversarial-simulation emphasis.

Summary

Leads security architecture efforts across all cybersecurity domains for new technology implementations, major system changes and mergers/acquisitions at an insurance and financial-services company, and drives updates to security standards and policies in response to regulatory or business change. The role communicates risk to executive leadership, performs third-party and cloud security risk assessments, serves as subject-matter expert during incident response, and supports SOX, PCI and HIPAA/HITECH compliance. The position is remote-eligible from EST or CST US locations and is not eligible for visa sponsorship.

Summary

Operational owner of a bank application penetration testing program rather than a hands-on tester, coordinating assessment intake, scheduling, readiness validation, remediation tracking, retesting and governance reporting. The role is the liaison between penetration testers, application teams, Application Security Champions and technology partners, facilitating discussion of vulnerabilities and remediation plans, and it doubles as ServiceNow product owner for the workflows that support the program. The stated qualification is 5 or more years of business systems data and design experience, and agile work intake and delivery forecasting are core duties.

Summary

A governance, risk and compliance role on Ovative Group's information security team, reporting to the Head of Information Security and Privacy. The operational core is client security questionnaires, vendor security assessments, SOC 2 evidence collection and audit support, the risk register and policy lifecycle, plus privacy compliance work under CCPA and GDPR including data mapping and data subject requests. A large second half of the job is standing up AI governance: running AI tool and vendor intake, conducting AI risk assessments, maintaining an inventory of approved tools, agents and connectors, and delivering secure-AI training, alongside security awareness campaigns, phishing simulations and periodic access reviews.

Summary

Engineering leadership over the enterprise data protection platform, running a geographically distributed engineering organization responsible for more than 500 petabytes of protected data across on-premises, hybrid and public cloud environments. The mandate is modernization: moving off traditional backup architectures onto policy-driven platforms with immutable storage, cyber vaulting, ransomware resilience and cloud-integrated recovery services spanning GCP, Azure and AWS. Infrastructure as code, API-driven automation and self-service consumption are the stated engineering levers, alongside resiliency assessments and recovery-readiness programs measured against recovery point and recovery time objectives, in partnership with Cybersecurity, Architecture, Risk and CIO teams.

Summary

Senior threat hunting and incident response inside a bank's security program — leading technical analysis of emerging threats, building and testing detection rules with engineering teams, mapping findings to MITRE ATT&CK, and automating hunts, with Jupyter notebooks and AI tooling featuring prominently. Also covers forensic and eDiscovery investigation support and training security operations staff.

Summary

An application security engineering role at U.S. Bank focused on CI/CD-integrated security tooling. It configures SAST, SCA, and DAST capabilities, triages vulnerabilities in ServiceNow, maintains Java automation, supports Docker/cloud environments, and contributes to AI application-security initiatives.

Summary

Lead engineer and primary technical owner of a Saviynt-based identity governance and administration platform, responsible for platform architecture, configuration and production readiness, joiner-mover-leaver lifecycle processes, access requests, certifications, provisioning logic and SaaS connectors and integrations. The role designs and enforces security controls including Conditional Access, Zero Trust principles and periodic access reviews, drives root-cause analysis and post-go-live stabilization, mentors junior engineers and shapes the long-term IGA roadmap. Seven or more years of IT experience with identity governance depth is required; candidates must be a US citizen or green card holder intending to naturalize, and must work full time on site within 50 miles of the employing Reserve Bank.

Summary

Medtronic is hiring a senior manager to lead operational technology cybersecurity for its manufacturing and distribution environments, translating enterprise security objectives into operational plans and standards across multiple sites. The scope spans OT network security, incident response, risk management and regulatory compliance for production and distribution systems that touch patient-impacting processes, and the role leads teams and drives alignment with engineering and manufacturing operations. It can be based at one of several US Medtronic facilities, with Mounds View, Minnesota preferred, or worked remotely within the US.

Summary

This role leads the Medtronic Security Culture function, running enterprise-wide cybersecurity awareness, communications and engagement programs aimed at reducing human-related cyber risk. It is program leadership centered on education and behavior change rather than hands-on technical security work, setting the strategic direction, maturity roadmap and operating model and aligning them with enterprise risk and business priorities. Medtronic expects four days a week onsite at one of several US sites, with a strong preference for Mounds View, Minnesota.

Summary

Runs Wells Fargo's cybersecurity wargame program: designing and facilitating business-focused tabletop exercises, grounding scenarios in current threat intelligence and organizational risk, and producing rulebooks, scenario injects, and technical playbooks. The work is exercise delivery and security education rather than hands-on defensive engineering, covering environment setup, participant scheduling, pre-exercise briefings, post-exercise debriefs, and targeted training, with the analyst as primary contact for participants and internal cybersecurity teams. The schedule is hybrid and the position is not eligible for visa sponsorship; Security Plus or similar certification is listed as a plus.

Summary

A principal software engineering role owning the security and compliance architecture for CoCounsel, translating frameworks such as SOC 2 Type II, ISO 27001/42001, HIPAA, and FedRAMP into technical controls. The work emphasizes compliance-as-code (automated evidence collection, continuous control monitoring, policy-as-code) plus encryption, key management, tenant isolation, and audit logging at production scale. Requires deep backend engineering (Python, Java, or Go) on AWS and hands-on identity and access management experience.

Summary

Security engineering role focused on enterprise cryptography, designing and scaling encryption and key-management solutions, hardware security modules, and data-protection technologies such as Thales CipherTrust, tokenization, format-preserving encryption, and transparent data encryption. It is hands-on across Linux and Windows with heavy scripting and automation (Bash, PowerShell, Python, Ansible) for OS hardening and HSM administration. It is in-office three days a week and explicitly offers no visa sponsorship or transfers.

Summary

A leadership role owning enterprise security architecture, engineering, and exposure management for a global Fortune 500 environment. Scope spans endpoint, cloud, network, data protection, collaboration, and OT security, plus standing up a new Continuous Threat Exposure Management capability and enforcing vulnerability remediation SLAs. The focus is the proactive, hardening side of security across multi-cloud, on-premises, and industrial control system environments.

Summary

Second-line-of-defense cybersecurity risk role at U.S. Bank, providing independent oversight and credible challenge of first-line security practices rather than hands-on security work. Performs risk-based assessments against NIST 800-53, FFIEC, PCI and NIST CSF, develops independent risk opinions, and escalates control weaknesses through governance channels. A senior, autonomous role expecting 8+ years; not eligible for visa sponsorship.

Summary

A hands-on data protection engineering role within a bank's IT organization, focused on discovering, classifying, monitoring, and protecting sensitive data and implementing data loss prevention controls. The role translates regulatory, privacy, and risk requirements into practical controls and sustainable operating processes in a regulated environment. It is part of an effort to mature the enterprise data protection program.

Summary

First-line cybersecurity risk role at Old National Bank, serving as subject matter expert and owner for five Tier 1 assessable units covering security operations, identity and access management, data protection, vulnerability management and threat intelligence. The position translates technical control performance into risk-rated assessments that drive leadership decisions, working daily with the CISO organization, the security operations center, the identity and access management team and data protection engineering, while managing relationships with internal audit, enterprise risk management and regulatory examiners. It was created in response to moving the information security and cyber security operations function into the IT organization, and it also partners with the CISO on defining and executing enterprise cybersecurity risk strategy.

Summary

Lead cyber threat intelligence analyst at a bank, conducting hands-on analysis of threat actors, campaigns, malware, phishing, and financial-sector threats and producing tactical, operational, and strategic intelligence products for security teams and leadership. Maps activity to MITRE ATT&CK and supports threat hunting, detection engineering, incident response, and vulnerability management as a senior individual contributor. Requires working from a US Bank location three or more days per week; no visa sponsorship.

Summary

This is a security-engineering role focused on container and host-based network micro-segmentation (Illumio), including hands-on implementation with application teams, maintaining security tooling, and participating in day-to-day Cyber Security Operations Center monitoring and incident response. It is a security-operations and network-segmentation specialty rather than software development. The employer states it will not sponsor work visas, so applicants must already be authorized to work in the US.

Summary

A client-facing IT audit and cybersecurity risk advisory role at a consulting and accounting firm, delivering risk, governance, internal audit, and compliance services with a HITRUST focus. The role sits within a Risk Advisory practice serving external clients rather than an internal security team. Work location arrangements are discussed per opportunity across several U.S. offices.

Summary

A senior security consultant role at NetSPI specializing in Kubernetes penetration testing: leading and delivering offensive-security exercises against Kubernetes environments using top-tier custom tools, and communicating findings effectively to both executive and technical teams. It wants demonstrated technical depth in Kubernetes pentesting plus strong problem-solving and collaboration skills; Minneapolis.

Summary

A senior penetration-testing consulting role at NetSPI specializing in mainframe testing, a niche offensive-security skill, conducting assessments, identifying vulnerabilities, and delivering client remediation guidance. It is strongest fit for pentesters with mainframe or legacy-systems security experience.

Summary

Effectively a Business Information Security Officer for Thomson Reuters' Legal products, correlating product and engineering risk, managing remediation, and handling customer security queries alongside the central customer-trust team. The role bridges C-suite communication and developer-level technical discussion, develops risk scorecards and security go-to-market materials, and works to frameworks like ISO 27001/2 and NIST. Hybrid (2-3 days in office); wants 6+ years in cybersecurity and prior BISO experience.

Summary

Offensive-security engineering within Target's Cyber Fusion Center, operating as red team to emulate real-world adversaries and probe the retailer's defenses. The technical-lead role centers on adversarial testing and driving improvements to detection and response. The posting is otherwise mostly benefits and culture boilerplate, so specific tooling and engagement scope are not detailed.

Summary

A security-engineering role focused on deploying and administering security tooling rather than software development, covering CrowdStrike Falcon endpoint and container security, firewalls and network segmentation, Netskope secure web gateway, and Infrastructure-as-Code automation. It is hybrid with a minimum of three office days per week, and the posted base range is $89,000 to $164,300.

Summary

This role executes Xcel Energy's enterprise security risk management program — running risk assessments and the risk-acceptance/remediation process, maintaining documentation in a GRC toolset, and translating technical risk into business terms for leadership and regulators. It requires 3+ years in a security function plus 2 years of risk-assessment/audit/control-testing experience, familiarity with NIST/ISO 27001 frameworks, and is based in Minneapolis.

Summary

An offensive security role on Target's Cyber Fusion Center red team, emulating real-world adversaries to probe and strengthen the company's defenses. You work hands-on as a senior red team operator in an environment built around continuous learning, engineering excellence, and strong security outcomes.

Summary

A senior offensive-security role leading threat-emulation and adversarial-simulation exercises across enterprise networks, applications, cloud, and physical-security domains. Develops custom tools, payloads, and exploits, leads purple-team engagements, and mentors junior operators; expertise with C2 frameworks (Cobalt Strike, Metasploit, Mythic, Sliver) and EDR/XDR evasion expected.

Summary

Threat detection engineering on Target's cybersecurity team — designing, building, and refining the detections that alert analysts to malicious activity, blending software engineering with security operations. As with Target's other listings, the posting is largely benefits and culture boilerplate, so the specific detection stack and data sources are not spelled out.

Summary

A cybersecurity leadership role directing an integrated program spanning Governance, Risk & Compliance, Identity & Access Management, and Operational Technology (OT) security for a global manufacturer. Responsibilities include maturing governance frameworks and regulatory compliance (SOX, GDPR, CMMC, TISAX), leading the IAM/ICAM function on SailPoint aligned to Zero Trust, overseeing OT/ICS security, and reporting cyber risk to leadership and the board. It requires 10+ years in cybersecurity/GRC/identity and certifications such as CISSP, CISM, CRISC, or CISA.

Summary

An offensive-security consulting role performing network penetration testing for clients, requiring demonstrated technical depth in network pentesting plus the communication skills to brief executive and technical stakeholders.

Summary

Detection engineering for Target's cybersecurity team — building and tuning the analytics and detection logic that surface malicious activity for security operations. The posting is mostly benefits and culture boilerplate, so specific tooling and data sources are not listed, but the work sits at the intersection of software engineering and threat detection.

Summary

A product security engineering role securing embedded and IoT medical devices within Medtronic's Neuroscience organization, which develops neuromodulation therapies such as spinal cord and deep brain stimulation and targeted drug delivery. You apply security expertise to connected, implantable device platforms in a regulated healthcare setting. This position is fully onsite.

Summary

Leading offensive security operations against a major bank's AI/ML systems — adversarial testing of LLMs and model pipelines (prompt injection, data poisoning, model inversion, jailbreaks) alongside traditional red teaming, plus building custom tooling and mentoring red team engineers. A senior technical-authority role requiring 8+ years of relevant experience.

Summary

Secures cardiac ablation medical devices at the embedded and firmware level, joining Medtronic's R&D organization to build cybersecurity into real-time and embedded systems. The posting explicitly notes this is product security, not IT security, compliance, or GRC. Requires partnering closely with device engineering teams and working onsite a minimum of four days a week.

Summary

A senior web-application penetration-testing consulting role at NetSPI, performing thorough security assessments and advising clients on remediation while contributing to security best practices. It is a hands-on, client-facing offensive-security seat, the senior counterpart to the level-II web pentest role.

Summary

A principal-level penetration-testing role at security firm NetSPI specializing in hardware and embedded systems, assessing devices for vulnerabilities and delivering actionable remediation. It is a hands-on, largely independent offensive-security consulting position requiring both deep technical depth and the ability to brief executive and technical stakeholders.

Summary

A mid-level web-application penetration-testing consulting role at NetSPI, conducting security assessments, identifying vulnerabilities, and delivering clear, actionable client reports. It is a hands-on offensive-security consultant seat focused on web apps.

Summary

A principal red-team operator role at offensive-security firm NetSPI, compromising sophisticated client networks on a globally deployed Red Team using proprietary tooling, and engaging both executives and technical teams. It is a senior, deeply technical adversarial-simulation consulting seat (US-based).

Summary

Engineering leadership role (Director) standing up and leading a new team within Target Cybersecurity focused on securing GenAI technologies, directing security architects to identify risks, develop mitigations, and embed security controls into system architecture. Described as highly technical and hands-on with scalable-system design while leading the engineering team; onsite in Brooklyn Park, MN.

Summary

Despite the generic Lead Engineer title, this is a malware reverse-engineering role on Target's Cyber Threat Intelligence team within the Cyber Fusion Center. Work centers on AI-assisted malware triage — validating machine-generated static and dynamic analysis, reversing critical code paths (loaders, unpacking, injection logic), analyzing obfuscation and anti-analysis techniques, and building detection logic (YARA, behavioral rules) across the security operation.

Summary

An IT Security Administrator focused on identity and access management — processing access requests, verifying authenticity against policy, and provisioning standard and privileged accounts — within a healthcare organization's 14-person security administration team. This is an access-governance and compliance support role rather than threat hunting; an associate degree (or equivalent experience) is required, and it may work remotely with local candidates preferred.

Summary

Client-facing IT audit and cybersecurity risk advisory role at a national accounting and consulting firm, with a focus on HITRUST assessments. Work involves evaluating clients' IT and security controls and helping them meet compliance and risk-management requirements.

Summary

A senior information security and technology risk manager role at Old National Bank operating in the second line of defense: establishing and maintaining the enterprise information-security and technology-risk framework (policies, standards, monitoring), providing independent challenge and oversight of first-line controls, and advising business units on regulatory expectations and risk appetite. It is a governance and risk-management role rather than hands-on security engineering; Minneapolis, 98,400 to 199,000 dollars plus bonus.

Summary

Leads a shift of CSIRT analysts in Target's cybersecurity defense operation, overseeing alert intake, triage, and incident response. This is a people-leadership role — managing analysts, developing processes and expectations, and coaching the team — within the incident-response function. The posting is otherwise mostly benefits and culture boilerplate, so tooling and shift specifics are not detailed.

Summary

A threat-intelligence analyst role that sits within U.S. Bank's physical-security function, monitoring and assessing threats to people, property and operations — emergency situations, unrest, criminal activity — using dark-web/OSINT monitoring and tools like Dataminr and Skopenow, and producing threat assessments for decision-makers. It is oriented toward corporate/physical-security intelligence rather than network cyber defense, requires onsite presence 3+ days/week, and includes an on-call rotation.

Summary

A director-level cloud security engineering role at Target. The work is leadership of cloud security strategy, engineering teams, and security-platform delivery for a large retail technology environment.

Summary

Runs and matures Solventum's enterprise vulnerability management program across infrastructure, cloud, and application environments at a healthcare company. Drives risk-based prioritization, partners with engineering teams to remediate findings, and supports audit and compliance in regulated environments. Blends deep hands-on security work with program ownership, automation, and stakeholder engagement rather than pure operations.

Summary

A Lead Engineer, AI Security (Security Architecture) role at Target focused on securing AI within the security-architecture function. The pay range is stated as $132,000-$238,000. A senior security-engineering role specializing in AI security at a major retailer.

Summary

A Senior Engineer, Threat Detection Operations role at Target's cybersecurity organization. The pay range is stated as $98,000-$176,000. The role focuses on threat-detection engineering within Target Cybersecurity. A security-engineering position at a major retailer.

Summary

A security-leadership role at Infinite Campus, a Minneapolis student-information-system SaaS company, running the SecOps function and managing a small team of SecOps, AppSec, and compliance staff. The work centers on application security, security monitoring, incident response (potentially as Incident Commander), and compliance drives such as SOC 2 and FedRAMP/GovRAMP, owning the security roadmap and part of the budget. Suited to a hands-on security leader comfortable with cloud, containers, and auditors; CISSP is highly desirable.

Summary

A managing-director role at West Monroe leading and growing its cybersecurity practice — a market-facing, growth-oriented leadership role that is heavily business-development-focused rather than hands-on technical. The core responsibilities are developing executive relationships (CISOs, CTOs, CIOs, PE investors), originating and closing new cybersecurity business across strategy, risk management, and transaction services, developing go-to-market strategies for AI-focused cybersecurity offerings (AI governance, secure AI adoption), and serving as a trusted advisor and thought leader, often partnering with West Monroe's M&A and private-equity teams. A fit for a seasoned cybersecurity leader with deep advisory expertise and a strong professional network who can create demand and build pipeline; based across West Monroe's US offices.

Summary

This is a security awareness and behavior-change role rather than hands-on technical security work, running Target's mature Cybersecurity Awareness and Training program as an individual contributor. You interpret risk signals alongside cyber SMEs, design targeted campaigns and learning experiences for technical audiences, and use risk-based metrics to measure and improve program impact.

Summary

A lead engineer role in Network Security Monitoring within Target Cybersecurity, based in Brooklyn Park, MN (pay range listed $132k-$238k). You would lead engineering for the systems that monitor Target's network for security threats. It suits a senior security/network engineer who wants a technical-lead role in a large retailer's cybersecurity organization.

Summary

A cybersecurity engineer (level II) at Travelers (Edison NJ, Richardson TX, Hartford CT, or St. Paul MN) with network and developer skills supporting perimeter controls, including firewall rule-request approvals and orchestration, with a salary range of 126,500 to 208,700 dollars. A network-security engineering role.

Summary

A lead engineer on Target's Cyber AI team applying AI to cybersecurity problems. Pay range 132k-238k. A security-engineering lead with an AI focus; for security engineers leaning into AI/ML.

Summary

An IAM Operations Engineer on Travelers' Cybersecurity org's Identity & Access Management team. Multi-location: Hartford CT / St. Paul MN. Disclosed range $127K-$209K.

Summary

A Lead Security Engineer on Target Cybersecurity's Proactive Security team — proactive threat-hunting and red-team-shaped offensive work at the retailer. Brooklyn Park HQ campus. Disclosed range $132K-$238K.

Summary

A senior Cloud Security Engineer at Old National Bank — owns cloud-security tooling and posture-management across the bank's cloud surface. Multi-location: Lake Elmo MN (Washington core ring) / Chicago IL / Evansville IN. Forward-looking software role on Old National's growing Twin Cities footprint.

Summary

A senior cybersecurity engineer at a bank focused specifically on internet proxy and web-filtering operations, integrating automation, application and monitoring systems. The role collaborates with the Cybersecurity Operations Center on security-automation use cases and leans on knowledge of SIEM, SOAR/orchestration, and remote browser isolation or enterprise browsers. It requires 3+ years in proxy/filtering tools, is office-based, does not sponsor visas, and lists a range of 57K to 113K.

Summary

A Director of Security Operations role at C.H. Robinson (a major logistics company), leading the SOC, incident response program, detection engineering, and security tooling (SIEM, SOAR, EDR) for a global enterprise. The position requires 7+ years of cybersecurity experience and 5+ years managing cross-functional security teams, with executive communication and program governance as significant components alongside technical oversight.

Summary

Leads the shared cybersecurity platforms that the rest of the security organization depends on, acting as product owner over their backlog, roadmap, and lifecycle from selection through deprecation. Builds and directs a multidisciplinary team of platform engineers, detection engineers, crypto and PKI specialists, and product managers, and ensures SOC and incident-response teams can wield the tooling during live incidents.

Summary

A process and governance role within the cybersecurity organization, building and continuously improving the security service catalog, service-management processes, and change-management framework. Serves as the main liaison to Enterprise IT Change Management to keep cybersecurity work compliant, controlled, and low-disruption, aligning artifacts and workflows to ITIL and audit requirements. An ITIL-oriented service-management position rather than hands-on security.

Summary

A communications role inside the cybersecurity organization, serving as the primary comms advisor to the CISO. The work is crafting executive messaging and high-impact PowerPoint presentations on security strategy and risk posture, running the Information Security Risk and Compliance communications calendar, and overseeing temporary and offshore comms staff. This is a writing and stakeholder-communication position, not a hands-on technical one.

Summary

A mid-to-senior cybersecurity risk analyst role at Deluxe (a fintech/payments company) focused on cyber resiliency — leading tabletop exercises, conducting IT risk assessments, maintaining the cyber risk management program documentation, and producing risk reporting for a regulated business. The posted compensation range is $120,000-$130,000 annually; 5-8+ years of risk management experience required.

Summary

A Lead Engineer on Target Cybersecurity's Incident Response Engineering team — owns IR-engineering tooling and runbooks for the F50 retailer. Brooklyn Park HQ campus. Disclosed range $132K-$238K.

Summary

A senior engineer on Target Cybersecurity's Incident Response Engineering team — specialist on IR tooling and detection-engineering work. Brooklyn Park HQ campus. Disclosed range $98K-$176K.

Summary

Cybersecurity compliance work centered on Sarbanes-Oxley IT general controls — testing, documenting, and helping remediate the security controls that protect the systems tied to financial reporting, within Target Technology Services. The listing is mostly benefits boilerplate, so exact frameworks and audit cadence are not detailed, but the role bridges security with audit and compliance.

Summary

Cybersecurity leadership role owning Tennant's enterprise security program - defining and executing strategy, overseeing security operations, building governance programs, and running audit-remediation and risk-acceptance frameworks to protect systems, networks, and data. Involves hands-on knowledge of CrowdStrike EDR and MDR/XDR and familiarity with NIST CSF, ISO 27001, and IEC 62443; certifications such as CISSP or CISM are preferred.