Cybersecurity Engineer - Security Operations

Kimley-Horn

Raleigh (NC)

On-site

USD 120,000 - 160,000

Full time

14 days+

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Benefits offered by this job

Retirement plan

Health coverage

Paid time off & flexible scheduling

Professional development & training

Job summary

Kimley-Horn is seeking an experienced Cybersecurity Engineer - Security Operations to own key SOC capabilities in an in-office role in Raleigh, NC. You will strengthen threat detection, incident response, monitoring, and security automation, serving as a senior escalation resource and guiding improvements across processes and tooling.

The role focuses on automating and maturing the SOC with orchestration, analytics, AI-assisted workflows, and enhanced EDR/XDR and SIEM capabilities.

Qualifications

Bachelor's degree in information security, cybersecurity, computer science, or related field or equivalent practical experience.
5+ years hands-on experience in security operations, incident response, or security engineering in enterprise environments.
Professional certifications such as GCIH, GCFA, OSIR, CISSP or equivalent.
Experience investigating and responding to security incidents across endpoints, identities, networks, emails, and cloud environments.

Responsibilities

Lead incident response operations as primary escalation point and mentored team members during on-call coverage.
Develop and continually improve incident response processes, playbooks, and escalation paths.
Serve as senior technical escalation resource for security incidents—lead investigations, containment, remediation, and lessons learned.
Advance SOC toward automation via orchestration, analytics, AI-assisted workflows, and process improvements.
Administer and optimize EDR/XDR technologies, including policy management and health.
Improve SIEM data collection and monitoring by onboarding data sources and developing detection logic.
Design automation for alert enrichment, triage, investigation, containment, and reporting.
Conduct proactive threat hunting using multiple telemetry sources to identify suspicious activity.
Collaborate with internal/external teams to improve detection, incident response, and security controls.
Participate in tabletop exercises to validate incident response readiness.
Prepare clear incident documentation and reporting for technical and non-technical stakeholders.

Skills

Incident response

Threat hunting

EDR/XDR

SIEM

SOAR

Automation

Leadership/mentorship

Technical escalation

Communication

Security operations

Education

Bachelor's degree in information security or related field

Tools

EDR/XDR tooling

SIEM platforms

SOAR platforms

APIs & automation

Job description

Discipline/Focus

Information Technology

Overview

Kimley-Horn, one of Fortune Magazine’s “100 Best Companies to Work For,” is seeking an experienced Cybersecurity Engineer - Security Operations to take technical ownership of key Security Operations capabilities. This hands on role will strengthen our threat detection, incident response, monitoring, and security automation capabilities. This position will serve as a senior technical escalation resource, improve operational processes and tooling, and help advance Kimley-Horn toward a more automated and autonomous SOC.

This is and in-office position.

Responsibilities

Lead incident response operations as the primary escalation point, providing technical guidance and mentorship to team members while managing the incident response on-call schedule and coverage

Develop, maintain, and continuously improve incident response processes, procedures, playbooks, and escalation paths

Serve as a senior technical escalation resource for security incidents, leading investigations, containment, remediation, recovery, and lessons-learned activities

Help advance the Security Operations program toward a more automated and autonomous SOC through orchestration, analytics, AI-assisted workflows, and continuous process improvement

Administer, optimize, and advance endpoint detection and response (EDR/XDR) technologies, including policy management, detection tuning, integrations, and operational health

Improve security event collection and monitoring within the SIEM by onboarding data sources, validating telemetry, developing correlation and detection logic.

Design and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to increase consistency and reduce manual effort or alert fatigue

Establish and conduct proactive threat hunting using endpoint, identity, email, network, cloud, and other security telemetry to identify suspicious activity

Partner with internal teams and external providers to improve detection coverage, coordinate incident response, and translate operational findings into actionable security improvements

Participate in tabletop exercises and simulations to validate and improve incident response readiness

Prepare clear incident documentation, metrics, and reports that communicate findings, actions taken, risk, and lessons learned to technical and non-technical stakeholders

Qualifications

Bachelor's degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience

Professional certifications such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification

5+ years of hands‑on experience in security operations, incident response, security engineering, threat detection, or a similar role within an enterprise environment

Demonstrated experience investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments

Strong experience administering and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions

Experience with SIEM architecture and operations, including log source onboarding, event collection, data validation, query development, correlation, and detection engineering

Experience developing and maintaining incident response playbooks, procedures, and escalation workflows

Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation

Experience performing threat hunting and translating findings into improved detections, controls, or response processes

Excellent analytical and problem‑solving skills, with the ability to make sound decisions during high‑pressure incidents

Strong written and verbal communication skills, with the ability to convey technical findings, risk, and recommended actions to technical and non‑technical stakeholders

Desired Skills:

Advanced knowledge of incident response methodologies, digital investigation techniques, and frameworks such as NIST and MITRE ATT&CK

Experience with Microsoft security technologies and enterprise EDR/XDR, SIEM, SOAR, and email security platforms

Proficiency with a scripting or automation language and experience integrating security tools through APIs

Familiarity with AI-assisted security operations, autonomous SOC concepts, or automated investigation and response

Experience creating operational metrics, dashboards, and reporting that demonstrate detection and response effectiveness

Why Kimley-Horn?

At Kimley-Horn, we do things differently. People, clients, and employees are at the forefront of who we are. Clients know we prioritize achieving their goals and growing their success. Employees know our culture and approach to business are built on a desire to provide an environment for everyone to flourish. Our commitment to quality is only as good as the people behind it— that’s why we welcome and develop passionate, hardworking, and proactive employees. We take pride in how our employee retention, robust benefits package, and company values have led to Kimley-Horn’s placement on the Fortune “100 Best Companies to Work” list for 19 years!

Key Benefits at Kimley-Horn