Cybersecurity Engineer

Kimley-Horn • Raleigh, NC

7d • Onsite

About The Position

Kimley-Horn is seeking an experienced Cybersecurity Engineer to take technical ownership of key Security Operations capabilities. This hands-on role strengthens threat detection, incident response, monitoring, and security automation. The position serves as a senior technical escalation resource, improves operational processes and tooling, and helps advance the organization toward a more automated and autonomous Security Operations Center. This is an in-office position.

Requirements

• Bachelor’s degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience.
• Professional certification such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification.
• At least 5 years of hands-on experience in security operations, incident response, security engineering, threat detection, or a similar role in an enterprise environment.
• Demonstrated experience investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments.
• Strong experience administering and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions.
• Experience with SIEM architecture and operations, including log source onboarding, event collection, data validation, query development, correlation, and detection engineering.
• Experience developing and maintaining incident response playbooks, procedures, and escalation workflows.
• Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation.
• Experience performing threat hunting and translating findings into improved detections, controls, or response processes.
• Excellent analytical and problem-solving skills, including the ability to make sound decisions during high-pressure incidents.
• Strong written and verbal communication skills, including the ability to convey technical findings, risk, and recommended actions to technical and non-technical stakeholders.

Nice To Haves

• Advanced knowledge of incident response methodologies, digital investigation techniques, and frameworks such as NIST and MITRE ATT&CK.
• Experience with Microsoft security technologies and enterprise EDR/XDR, SIEM, SOAR, and email security platforms.
• Proficiency with a scripting or automation language and experience integrating security tools through APIs.
• Familiarity with AI-assisted security operations, autonomous SOC concepts, or automated investigation and response.
• Experience creating operational metrics, dashboards, and reporting that demonstrate detection and response effectiveness.

Responsibilities

• Lead incident response operations as the primary escalation point, provide technical guidance and mentorship, and manage the incident response on-call schedule and coverage.
• Develop, maintain, and continuously improve incident response processes, procedures, playbooks, and escalation paths.
• Lead investigations, containment, remediation, recovery, and lessons-learned activities for escalated security incidents.
• Advance Security Operations toward a more automated and autonomous SOC through orchestration, analytics, AI-assisted workflows, and continuous process improvement.
• Administer and optimize endpoint detection and response (EDR/XDR) technologies, including policy management, detection tuning, integrations, and operational health.
• Improve SIEM event collection and monitoring by onboarding data sources, validating telemetry, and developing correlation and detection logic.
• Design and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to increase consistency and reduce manual effort or alert fatigue.
• Establish and conduct proactive threat hunting across endpoint, identity, email, network, cloud, and other security telemetry.
• Partner with internal teams and external providers to improve detection coverage, coordinate incident response, and turn operational findings into actionable security improvements.
• Participate in tabletop exercises and simulations to validate and improve incident response readiness.
• Prepare clear incident documentation, metrics, and reports communicating findings, actions taken, risk, and lessons learned to technical and non-technical stakeholders.

Benefits

• 2-to-1 company match on up to 4% of eligible compensation (salary plus bonus) and an additional profit-sharing contribution.
• Low-cost medical, dental, and vision insurance options.
• Personal leave, flexible scheduling, floating holidays, and half-day Fridays.
• Student loan matching in the 401(k) and performance-based bonuses.
• Tuition reimbursement and extensive internal training programs.
• New Parent Leave, family building benefits, and childcare resources.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior