Cybersecurity Engineer

Kimley-Horn is seeking an experienced Cybersecurity Engineer to provide technical ownership of key Security Operations capabilities. This hands-on position focuses on strengthening threat detection, incident response, monitoring, and security automation, with the engineer acting as a senior technical escalation resource to advance toward a more automated and autonomous SOC.

Location

Raleigh, NC (onsite)

Role Overview

The Cybersecurity Engineer will lead and improve operational capabilities across incident response and detection engineering. Responsibilities include administering and optimizing EDR/XDR technologies, enhancing SIEM monitoring through data onboarding and telemetry validation, and building automation to improve alert enrichment, triage, investigation, containment, response, and reporting. The role also includes proactive threat hunting and participation in readiness exercises.

Responsibilities

• Lead incident response operations as the primary escalation point, providing technical guidance and mentorship while managing the incident response on-call schedule and coverage
• Develop, maintain, and continuously improve incident response processes, procedures, playbooks, and escalation paths
• Serve as a senior technical escalation resource for security incidents, leading investigations, containment, remediation, recovery, and lessons-learned activities
• Advance the Security Operations program toward a more automated and autonomous SOC through orchestration, analytics, AI-assisted workflows, and continuous process improvement
• Administer, optimize, and advance endpoint detection and response (EDR/XDR) technologies, including policy management, detection tuning, integrations, and operational health
• Improve security event collection and monitoring within the SIEM by onboarding data sources, validating telemetry, developing correlation and detection logic
• Design and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to increase consistency and reduce manual effort or alert fatigue
• Establish and conduct proactive threat hunting across endpoint, identity, email, network, cloud, and other security telemetry to identify suspicious activity
• Partner with internal teams and external providers to improve detection coverage, coordinate incident response, and translate operational findings into actionable security improvements
• Participate in tabletop exercises and simulations to validate and improve incident response readiness
• Prepare clear incident documentation, metrics, and reports that communicate findings, actions taken, risk, and lessons learned to technical and non-technical stakeholders

Minimum Requirements

• Bachelor’s degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience
• Professional certifications such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification
• 5+ years of hands-on experience in security operations, incident response, security engineering, threat detection, or a similar enterprise role
• Demonstrated experience investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments
• Strong experience administering and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions
• Experience with SIEM architecture and operations, including log source onboarding, event collection, data validation, query development, correlation, and detection engineering
• Experience developing and maintaining incident response playbooks, procedures, and escalation workflows
• Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation
• Experience performing threat hunting and translating findings into improved detections, controls, or response processes
• Excellent analytical and problem-solving skills, with the ability to make sound decisions during high-pressure incidents
• Strong written and verbal communication skills for technical and non-technical stakeholders

Technologies

Endpoint detection and response (EDR/XDR), SIEM, security orchestration, automation, and response (SOAR), NIST, MITRE ATT&CK, Microsoft security technologies, SOAR, EDR, XDR, email security platforms

Benefits

• Exceptional Retirement Plan: 2-to-1 company match on up to 4% of eligible compensation (salary + bonus) and additional profit-sharing contribution
• Comprehensive Health Coverage: low-cost medical, dental, and vision insurance options
• Time Off: personal leave, flexible scheduling, floating holidays, and half-day Fridays
• Financial Wellness: student loan matching in our 401(k), and performance-based bonuses
• Professional Development: tuition reimbursement and extensive internal training programs
• Family-Friendly Benefits: new parent leave, family building benefits, and childcare resources

Desired Skills

• Advanced knowledge of incident response methodologies, digital investigation techniques, and frameworks such as NIST and MITRE ATT&CK
• Experience with Microsoft security technologies and enterprise EDR/XDR, SIEM, SOAR, and email security platforms
• Proficiency with a scripting or automation language and experience integrating security tools through APIs
• Familiarity with AI-assisted security operations, autonomous SOC concepts, or automated investigation and response
• Experience creating operational metrics, dashboards, and reporting that demonstrate detection and response effectiveness