Cybersecurity Engineer

Kimley-Horn is hiring an experienced Cybersecurity Engineer to own core Security Operations capabilities, improving detection, incident response, monitoring, and automation.

Responsibilities

• Own incident response operations as the primary escalation point
• Provide technical guidance and mentorship to team members
• Manage the incident response on-call schedule and coverage
• Develop, maintain, and continuously improve incident response processes, procedures, playbooks, and escalation paths
• Act as a senior technical escalation resource for security incidents
• Lead investigations, containment, remediation, recovery, and lessons-learned activities
• Advance the Security Operations program toward a more automated and autonomous SOC using orchestration, analytics, AI-assisted workflows, and continuous process improvement
• Administer, optimize, and advance EDR/XDR technologies, including policy management, detection tuning, integrations, and operational health
• Improve security event collection and monitoring within the SIEM
• Onboard data sources, validate telemetry, and develop correlation and detection logic
• Design and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to reduce manual effort and alert fatigue
• Conduct proactive threat hunting across endpoint, identity, email, network, cloud, and other security telemetry
• Partner with internal teams and external providers to improve detection coverage and coordinate incident response
• Translate operational findings into actionable security improvements
• Participate in tabletop exercises and simulations to validate and improve incident response readiness
• Prepare clear incident documentation, metrics, and reports for technical and non-technical stakeholders

Requirements

• Bachelor’s degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience
• Professional certifications such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification
• 5+ years of hands-on experience in security operations, incident response, security engineering, threat detection, or a similar enterprise role
• Demonstrated experience investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments
• Strong experience administering and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions
• Experience with SIEM architecture and operations: log source onboarding, event collection, data validation, query development, correlation, and detection engineering
• Experience developing and maintaining incident response playbooks, procedures, and escalation workflows
• Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation
• Experience performing threat hunting and translating findings into improved detections, controls, or response processes
• Excellent analytical and problem-solving skills with sound decision-making during high-pressure incidents
• Strong written and verbal communication skills for conveying technical findings, risk, and recommended actions to technical and non-technical stakeholders

Technologies

• Endpoint detection and response (EDR/XDR)
• SIEM
• Security orchestration, automation, and response (SOAR)
• NIST
• MITRE ATT&CK
• Microsoft security technologies
• EDR
• XDR
• Email security platforms

Location & Work Mode

• Raleigh, NC
• Onsite

Benefits

• Exceptional Retirement Plan: 2-to1 company match on up to 4% of eligible compensation (salary + bonus) and additional profit-sharing contribution
• Comprehensive Health Coverage: Low-cost medical, dental, and vision insurance options
• Time Off: Personal leave, flexible scheduling, floating holidays, and half-day Fridays
• Financial Wellness: Student loan matching in our 401(k) and performance-based bonuses
• Professional Development: Tuition reimbursement and extensive internal training programs
• Family-Friendly Benefits: New Parent Leave, family building benefits, and childcare resources

Desired Skills

• Advanced knowledge of incident response methodologies, digital investigation techniques, and frameworks such as NIST and MITRE ATT&CK
• Experience with Microsoft security technologies and enterprise EDR/XDR, SIEM, SOAR, and email security platforms
• Proficiency with a scripting or automation language and experience integrating security tools through APIs
• Familiarity with AI-assisted security operations, autonomous SOC concepts, or automated investigation and response
• Experience creating operational metrics, dashboards, and reporting that demonstrate detection and response effectiveness