Cybersecurity Engineer

CBRE; Dallas (TX); On-site; USD 120,000 - 160,000; Full time

Job summary

CBRE is seeking a Cybersecurity Engineer to deploy, operate and tune security controls across endpoints, email security, web proxies, and cloud platforms in a large, global environment. You will work with SIEM and data pipelines to detect threats and investigate incidents, while collaborating with cross-functional teams to implement hardening measures and maintain runbooks.

The role emphasizes hands-on security engineering with opportunities to grow into senior competencies, across MITRE ATT&CK

Qualifications

• Three+ years in information security or related field.
• Hands-on security engineering or SOC experience.
• Experience with at least two security tech areas (EDR, gateways, firewalls, proxies, cloud logging).
• Familiarity with MITRE ATT&CK framework and identity-based attacks.
• SQL and Python for log analysis and automation.
• Clear written communication.

Responsibilities

• Deploy, configure and maintain security controls across endpoints, email, web proxy, firewall and cloud platforms.
• Monitor and onboard log sources; troubleshoot ingestion and schema issues.
• Support MITRE ATT&CK assessments by documenting log source coverage.
• Build and tune detections in SIEM and data pipelines.
• Investigate suspicious activity and document findings for incidents.
• Run IOC searches across networks, identity, cloud and email logs.
• Write scripts and integrations to automate tasks.
• Collaborate with network and cloud teams to implement hardening changes.
• Track vulnerability and threat intel; translate into patch/detection priorities.
• Maintain runbooks and investigation notes.
• Participate in on-call rotations.

Skills

EDR platforms

Email security

Next-gen firewalls

Web proxies

Cloud logging

Azure AD / Entra

SIEM

Python scripting

SQL

Investigation skills

Tools

Databahn

Cribl

SOAR tooling

CrowdStrike Falcon

Job description

About the role

CBRE runs one of the largest and most varied technology estates in commercial real estate: corporate networks across more than 100 countries, cloud platforms on AWS, Azure and Google Cloud, client-facing applications, and building systems in the properties we manage. Protecting that estate takes a team of engineers who understand how the pieces fit together and where attackers look for gaps.

As a Cybersecurity Engineer, you deploy, operate and tune the security controls and detection pipelines that defend that estate. You work across identity, endpoint, network, cloud and email security under the guidance of senior engineers and architects. You make sure security telemetry reaches the security operations center (SOC) in usable form, you investigate what the tools surface, and you fix problems at the source.

This is a hands‑on role for someone who has solid security fundamentals and wants to build depth across multiple technologies in a large, global environment.

What you will do

• Deploy, configure and maintain security controls across endpoint detection and response (EDR), email security, web proxy, firewall, identity and cloud platforms.

• Monitor log-source health for the security data pipeline. Onboard new sources, troubleshoot ingestion and parsing failures, and escalat schema issues that need architectural changes.

• Support detection‑coverage assessments against the MITRE ATT&CK framework by gathering evidence of what each log source captures and documenting gaps.

• Build and tune detections in the security information and event management (SIEM) and data pipeline platforms, working from requirements set by senior engineers.

• Conduct technical investigations into suspicious activity: unusual sign‑ins, credential attacks, malware delivery, and suspicious network traffic. Document findings clearly and elevate confirmed incidents.

• Run indicator‑of‑compromise searches across network, identity, cloud and email logs when threat intelligence or an incident calls for it.

• Write and maintain scripts and integrations that automate repetitive security tasks.

• Work with network, identity, cloud and infrastructure teams to implement hardening changes and validate that fixes hold.

• Track vulnerability and threat intelligence relevant to the CBRE technology stack and help translate it into patch and detection priorities.

• Maintain technical documentation: runbooks, configuration records and investigation notes.

• Participate in an on‑call rotation for security tooling and pipeline issues.

What you bring

Required

• Three or more years in information security, IT infrastructure or a related technical role, with at least one year of hands‑on security engineering or SOC experience.

• Working experience with at least two of: EDR platforms (for example, CrowdStrike Falcon or Microsoft Defender), email security gateways, next‑generation firewalls (for example, Palo Alto Networks), web proxies, web application firewalls, or cloud‑native logging (AWS CloudTrail, VPC Flow Logs, Azure Monitor).

• Familiarity with Microsoft Entra ID (Azure AD) and common identity‑based attack patterns such as password spraying and impossible‑travel sign‑ins.

• Exposure to a SIEM or security data pipeline platform, including reading and searching logs and understanding how parsing and normalization work.

• Basic familiarity with the MITRE ATT&CK framework and how techniques map to log sources.

• Proficiency in SQL and at least one scripting language (Python preferred) for log analysis and basic automation.

• Sound troubleshooting instincts and the ability to work through an investigation methodically from indicator to conclusion.

• Clear written communication. You can explain a technical finding to a colleague who was not in the room.

Preferred

• Experience with security data pipeline platforms (for example, Databahn, Cribl) or SOAR and automation tooling (for example, Torq).

• Cloud security exposure on AWS, Azure or Google Cloud.

• One or more of: Security+, CySA+, GCIH, GSEC, or an entry‑level vendor certification (CrowdStrike, Palo Alto Networks PCNSA, Microsoft SC‑200 or SC‑900).

• Experience working in a multi‑entity or multi‑tenant environment.

How we work

We value engineers who are direct about what is broken and specific about how to fix it. You will get real access, real ownership of defined workstreams, and senior engineers who expect you to ask questions and challenge assumptions. We invest in people who want to grow; this role is a clear path to senior engineering.

CBRE's RISE values, Respect, Integrity, Service and Excellence, define how we treat each other and our clients. They apply to how we run security, too: we protect people first, we tell the truth about risk, and we hold ourselves to the standard we ask of others.

Why CBRE

CBRE is the world's largest commercial real estate services and investment firm, with more than 140,000 employees serving clients in more than 100 countries. Few security teams see the range of technology, geography and threat activity you will see here, which makes it a strong place to build a career.

Equal opportunity

CBRE is an equal opportunity employer. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status or any other characteristic protected by law.

Our Values in Hiring

At CBRE, we are committed to fostering a culture where everyone feels they belong. We value diverse perspectives and experiences, and we welcome all applications.

Disclaimers

Applicants must be currently authorized to work in the United States without the need for visa sponsorship now or in the future.

Applicant AI Use Disclosure

We value human interaction to understand each candidate's unique experience, skills and aspirations. We do not use artificial intelligence (AI) tools to make hiring decisions, and we ask that candidates disclose any use of AI in the application and interview process.

About CBRE Group, Inc.

CBRE Group, Inc. (NYSE:CBRE), a Fortune 500 and S&P 500 company headquartered in Dallas, is the world’s largest commercial real estate services and investment firm (based on 2024 revenue). The company has more than 140,000 employees (including Turner & Townsend employees) serving clients in more than 100 countries. CBRE serves clients through four business segments: Advisory (leasing, sales, debt origination, mortgage serving, valuations); Building Operations & Experience (facilities management, property management, flex space & experience); Project Management (program management, project management, cost consulting); Real Estate Investments (investment management, development). Please visit our website at www.cbre.com.

Equal Employment Opportunity

CBRE is an equal opportunity employer that values diversity. We have a long‑standing commitment to providing equal employment opportunity to all qualified applicants regardless of race, color, religion, national origin, sex, sexual orientation, gender identity, pregnancy, age, citizenship, marital status, disability, veteran status, political belief, or any other basis protected by applicable law.

Candidate Accommodations

CBRE values the differences of all current and prospective employees and recognizes how every employee contributes to our company's success. CBRE provides reasonable accommodations in job application procedures for individuals with disabilities. If you require assistance due to a disability in the application or recruitment process, please submit a request via email at [e-mail] or via telephone at [phone] (U.S.) and [phone] (Canada).

CBRE, Inc. is an Equal Opportunity and Aff…