Cybersecurity Engineer

Kimley-Horn; Raleigh (NC); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Excellent Retirement Plan

Comprehensive Health Coverage

Time Off and Flexible Scheduling

Financial Wellness and Bonuses

Professional Development and Training

Family-Friendly Benefits

Job summary

Kimley-Horn in Raleigh seeks a Cybersecurity Engineer to own key Security Operations capabilities. This hands-on role strengthens threat detection, incident response, monitoring, and security automation within an in-office setting.

You will lead IR operations, develop playbooks, and elevate SOC maturity by integrating SOAR, analytics, and AI-assisted workflows. Expertise in EDR/XDR and SIEM is required to protect enterprise assets.

Qualifications

• Bachelor’s degree in information security or related field.
• 5+ years in security operations or incident response.
• Hands-on with EDR/XDR, SIEM, and SOAR.
• Experience in enterprise security incidents.
• Relevant security certifications preferred.

Responsibilities

• Lead incident response operations as primary escalation point.
• Develop and improve incident response playbooks and escalation paths.
• Investigate, contain, remediate, and document lessons learned.
• Advance SOC automation through orchestration and analytics.
• Administer and optimize EDR/XDR technologies and telemetry.
• Onboard data sources to SIEM and refine detections.
• Design automated alert enrichment and response workflows.
• Conduct proactive threat hunting across multiple telemetry sources.
• Collaborate with internal teams and vendors for improvements.
• Prepare incident reports and metrics for stakeholders.

Skills

Incident Response

Threat Detection

Security Operations

On-call Leadership

Education

Bachelor’s degree in information security or related field

Tools

SIEM

EDR/XDR

SOAR

APIs

Job description

Overview

Kimley-Horn, one of Fortune Magazine’s “100 Best Companies to Work For,” is seeking an experienced Cybersecurity Engineer to take technical ownership of key Security Operations capabilities. This hands on role will strengthen our threat detection, incident response, monitoring, and security automation capabilities. This position will serve as a senior technical escalation resource, improve operational processes and tooling, and help advance Kimley-Horn toward a more automated and autonomous SOC.

This is and in-office position.

Responsibilities

• Lead incident response operations as the primary escalation point, providing technical guidance and mentorship to team members while managing the incident response on-call schedule and coverage
• Develop, maintain, and continuously improve incident response processes, procedures, playbooks, and escalation paths
• Serve as a senior technical escalation resource for security incidents, leading investigations, containment, remediation, recovery, and lessons‑learned activities
• Help advance the Security Operations program toward a more automated and autonomous SOC through orchestration, analytics, AI-assisted workflows, and continuous process improvement
• Administer, optimize, and advance endpoint detection and response (EDR/XDR) technologies, including policy management, detection tuning, integrations, and operational health
• Improve security event collection and monitoring within the SIEM by onboarding data sources, validating telemetry, developing correlation and detection logic.
• Design and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to increase consistency and reduce manual effort or alert fatigue
• Establish and conduct proactive threat hunting using endpoint, identity, email, network, cloud, and other security telemetry to identify suspicious activity
• Partner with internal teams and external providers to improve detection coverage, coordinate incident response, and translate operational findings into actionable security improvements
• Participate in tabletop exercises and simulations to validate and improve incident response readiness
• Prepare clear incident documentation, metrics, and reports that communicate findings, actions taken, risk, and lessons learned to technical and non-technical stakeholders

Qualifications

• Bachelor’s degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience
• Professional certifications such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification
• 5+ years of hands-on experience in security operations, incident response, security engineering, threat detection, or a similar role within an enterprise environment
• Demonstrated experience investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments
• Strong experience administering and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions
• Experience with SIEM architecture and operations, including log source onboarding, event collection, data validation, query development, correlation, and detection engineering
• Experience developing and maintaining incident response playbooks, procedures, and escalation workflows
• Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation
• Experience performing threat hunting and translating findings into improved detections, controls, or response processes
• Excellent analytical and problem-solving skills, with the ability to make sound decisions during high-pressure incidents
• Strong written and verbal communication skills, with the ability to convey technical findings, risk, and recommended actions to technical and non-technical stakeholders

Desired Skills:

• Advanced knowledge of incident response methodologies, digital investigation techniques, and frameworks such as NIST and MITRE ATT&CK
• Experience with Microsoft security technologies and enterprise EDR/XDR, SIEM, SOAR, and email security platforms
• Proficiency with a scripting or automation language and experience integrating security tools through APIs
• Familiarity with AI-assisted security operations, autonomous SOC concepts, or automated investigation and response
• Experience creating operational metrics, dashboards, and reporting that demonstrate detection and response effectiveness

Why Kimley-Horn?

At Kimley-Horn, we do things differently. People, clients, and employees are at the forefront of who we are. Clients know we prioritize achieving their goals and growing their success. Employees know our culture and approach to business are built on a desire to provide an environment for everyone to flourish. Our commitment to quality is only as good as the people behind it- that’s why we welcome and develop passionate, hardworking, and proactive employees. We take pride in how our employee retention, robust benefits package, and company values have led to Kimley-Horn’s placement on the Fortune “100 Best Companies to Work” list for 19 years!

Key Benefits at Kimley-Horn

• Exceptional Retirement Plan: 2-to1- company match on up to 4% of eligible compensation (salary + bonus) and additional profit-sharing contribution.
• Comprehensive Health Coverage: Low-cost medical, dental, and vision insurance options.
• Time Off: Personal leave, flexible scheduling, floating holidays, and half-day Fridays.
• Financial Wellness: Student loan matching in our 401(k), and performance-based bonuses.
• Professional Development: Tuition reimbursement and extensive internal training programs.
• Family-Friendly Benefits: New Parent Leave, family building benefits, and childcare resources.