Cybersecurity Engineer

Kimley-Horn; Raleigh (NC); Vor Ort; USD 110.000 - 150.000; Vollzeit

Benefits dieser Stelle

Exceptional Retirement Plan

Comprehensive Health Coverage

Time Off and Flexible Scheduling

Tuition reimbursement and Professional

Professional Development

Family-Friendly Benefits

Zusammenfassung

Kimley-Horn is seeking an experienced Cybersecurity Engineer to take operational ownership of key Security Operations capabilities. This hands-on role will strengthen threat detection, incident response, monitoring, and security automation while serving as a senior escalation resource and advancing towards a more automated SOC.

The position is in‑office in Raleigh, NC, with a focus on leading IR efforts, developing playbooks, tuning EDR/XDR, and enhancing SIEM/SOAR integration for proactive

Qualifikationen

• Bachelor's degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience.
• Professional certifications such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification.
• 5+ years of hands‑on experience in security operations, incident response, security engineering, threat detection, or a similar role within an enterprise environment.
• Demonstrated experience investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments.
• Strong experience administering and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions.
• Experience with SIEM architecture and operations, including log source onboarding, event collection, data validation, query development, correlation, and detection engineering.
• Experience developing and maintaining incident response playbooks, procedures, and escalation workflows.
• Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation.
• Experience performing threat hunting and translating findings into improved detections, controls, or response processes.
• Excellent analytical and problem‑solving skills, with the ability to make sound decisions during high‑pressure incidents.
• Strong written and verbal communication skills, with the ability to convey technical findings, risk, and recommended actions to technical and non‑technical stakeholders.

Aufgaben

• Lead incident response operations as the primary escalation point, providing technical guidance and mentorship to team members while managing the incident response on-call schedule and coverage.
• Develop, maintain, and continuously improve incident response processes, procedures, playbooks, and escalation paths.
• Serve as a senior technical escalation resource for security incidents, leading investigations, containment, remediation, recovery, and lessons-learned activities.
• Help advance the Security Operations program toward a more automated and autonomous SOC through orchestration, analytics, AI-assisted workflows, and continuous process improvement.
• Administer, optimize, and advance endpoint detection and response (EDR/XDR) technologies, including policy management, detection tuning, integrations, and operational health.
• Improve security event collection and monitoring within the SIEM by onboarding data sources, validating telemetry, developing correlation and detection logic.
• Design and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to increase consistency and reduce manual effort or alert fatigue.
• Establish and conduct proactive threat hunting using endpoint, identity, email, network, cloud, and other security telemetry to identify suspicious activity.
• Partner with internal teams and external providers to improve detection coverage, coordinate incident response, and translate operational findings into actionable security improvements.
• Participate in tabletop exercises and simulations to validate and improve incident response readiness.
• Prepare clear incident documentation, metrics, and reports that communicate findings, actions taken, risk, and lessons learned to technical and non-technical stakeholders.

Kenntnisse

Incident response

Threat detection

Security engineering

SOAR

EDR/XDR

SIEM

Ausbildung

Bachelor's degree or equivalent

Tools

EDR/XDR platforms

SIEM

SOAR

APIs

Jobbeschreibung

Overview

Kimley-Horn, one of Fortune Magazine’s “100 Best Companies to Work For,” is seeking an experienced Cybersecurity Engineer to take technical ownership of key Security Operations capabilities. This hands on role will strengthen our threat detection, incident response, monitoring, and security automation capabilities. This position will serve as a senior technical escalation resource, improve operational processes and tooling, and help advance Kimley-Horn toward a more automated and autonomous SOC.

This is an in-office position.

Responsibilities

• Lead incident response operations as the primary escalation point, providing technical guidance and mentorship to team members while managing the incident response on-call schedule and coverage
• Develop, maintain, and continuously improve incident response processes, procedures, playbooks, and escalation paths
• Serve as a senior technical escalation resource for security incidents, leading investigations, containment, remediation, recovery, and lessons-learned activities
• Help advance the Security Operations program toward a more automated and autonomous SOC through orchestration, analytics, AI-assisted workflows, and continuous process improvement
• Administer, optimize, and advance endpoint detection and response (EDR/XDR) technologies, including policy management, detection tuning, integrations, and operational health
• Improve security event collection and monitoring within the SIEM by onboarding data sources, validating telemetry, developing correlation and detection logic.
• Design and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to increase consistency and reduce manual effort or alert fatigue
• Establish and conduct proactive threat hunting using endpoint, identity, email, network, cloud, and other security telemetry to identify suspicious activity
• Partner with internal teams and external providers to improve detection coverage, coordinate incident response, and translate operational findings into actionable security improvements
• Participate in tabletop exercises and simulations to validate and improve incident response readiness
• Prepare clear incident documentation, metrics, and reports that communicate findings, actions taken, risk, and lessons learned to technical and non-technical stakeholders

Qualifications

• Bachelor’s degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience
• Professional certifications such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification
• 5+ years of hands‑on experience in security operations, incident response, security engineering, threat detection, or a similar role within an enterprise environment
• Demonstrated experience investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments
• Strong experience administering and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions
• Experience with SIEM architecture and operations, including log source onboarding, event collection, data validation, query development, correlation, and detection engineering
• Experience developing and maintaining incident response playbooks, procedures, and escalation workflows
• Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation
• Experience performing threat hunting and translating findings into improved detections, controls, or response processes
• Excellent analytical and problem‑solving skills, with the ability to make sound decisions during high‑pressure incidents
• Strong written and verbal communication skills, with the ability to convey technical findings, risk, and recommended actions to technical and non‑technical stakeholders

Desired Skills

• Advanced knowledge of incident response methodologies, digital investigation techniques, and frameworks such as NIST and MITRE ATT&CK
• Experience with Microsoft security technologies and enterprise EDR/XDR, SIEM, SOAR, and email security platforms
• Proficiency with a scripting or automation language and experience integrating security tools through APIs
• Familiarity with AI‑assisted security operations, autonomous SOC concepts, or automated investigation and response
• Experience creating operational metrics, dashboards, and reporting that demonstrate detection and response effectiveness

Why Kimley-Horn?

At Kimley-Horn, we do things differently. People, clients, and employees are at the forefront of who we are. Clients know we prioritize achieving their goals and growing their success. Employees know our culture and approach to business are built on a desire to provide an environment for everyone to flourish. Our commitment to quality is only as good as the people behind it— that’s why we welcome and develop passionate, hardworking, and proactive employees. We take pride in how our employee retention, robust benefits package, and company values have led to Kimley-Horn’s placement on the Fortune “100 Best Companies to Work” list for 19 years!

Key Benefits at Kimley-Horn

• Exceptional Retirement Plan: 2-to1- company match on up to 4% of eligible compensation (salary + bonus) and additional profit‑sharing contribution.
• Comprehensive Health Coverage: Low‑cost medical, dental, and vision insurance options.
• Time Off: Personal leave, flexible scheduling, floating holidays, and half‑day Fridays.
• Financial Wellness: Student loan matching in our 401(k), and performance‑based bonuses.
• Professional Development: Tuition reimbursement and extensive internal training programs.
• Family‑Friendly Benefits: New Parent Leave, family building benefits, and childcare resources.