Senior Cybersecurity Engineer | Incident Response & SOC

Kimley-Horn; Raleigh (NC); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Exceptional Retirement Plan

Comprehensive Health Coverage

Time Off and Flexible Scheduling

Tuition reimbursement and Professional

Professional Development

Family-Friendly Benefits

Job summary

Kimley-Horn is seeking an experienced Cybersecurity Engineer to take operational ownership of key Security Operations capabilities. This hands-on role will strengthen threat detection, incident response, monitoring, and security automation while serving as a senior escalation resource and advancing towards a more automated SOC.

The position is in‑office in Raleigh, NC, with a focus on leading IR efforts, developing playbooks, tuning EDR/XDR, and enhancing SIEM/SOAR integration for proactive

Qualifications

• Bachelor's degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience.
• Professional certifications such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification.
• 5+ years of hands‑on experience in security operations, incident response, security engineering, threat detection, or a similar role within an enterprise environment.
• Demonstrated experience investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments.
• Strong experience administering and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions.
• Experience with SIEM architecture and operations, including log source onboarding, event collection, data validation, query development, correlation, and detection engineering.
• Experience developing and maintaining incident response playbooks, procedures, and escalation workflows.
• Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation.
• Experience performing threat hunting and translating findings into improved detections, controls, or response processes.
• Excellent analytical and problem‑solving skills, with the ability to make sound decisions during high‑pressure incidents.
• Strong written and verbal communication skills, with the ability to convey technical findings, risk, and recommended actions to technical and non‑technical stakeholders.

Responsibilities

• Lead incident response operations as the primary escalation point, providing technical guidance and mentorship to team members while managing the incident response on-call schedule and coverage.
• Develop, maintain, and continuously improve incident response processes, procedures, playbooks, and escalation paths.
• Serve as a senior technical escalation resource for security incidents, leading investigations, containment, remediation, recovery, and lessons-learned activities.
• Help advance the Security Operations program toward a more automated and autonomous SOC through orchestration, analytics, AI-assisted workflows, and continuous process improvement.
• Administer, optimize, and advance endpoint detection and response (EDR/XDR) technologies, including policy management, detection tuning, integrations, and operational health.
• Improve security event collection and monitoring within the SIEM by onboarding data sources, validating telemetry, developing correlation and detection logic.
• Design and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to increase consistency and reduce manual effort or alert fatigue.
• Establish and conduct proactive threat hunting using endpoint, identity, email, network, cloud, and other security telemetry to identify suspicious activity.
• Partner with internal teams and external providers to improve detection coverage, coordinate incident response, and translate operational findings into actionable security improvements.
• Participate in tabletop exercises and simulations to validate and improve incident response readiness.
• Prepare clear incident documentation, metrics, and reports that communicate findings, actions taken, risk, and lessons learned to technical and non-technical stakeholders.

Skills

Incident response

Threat detection

Security engineering

SOAR

EDR/XDR

SIEM

Education

Bachelor's degree or equivalent

Tools

EDR/XDR platforms

SIEM

SOAR

APIs

Job description

Kimley-Horn is seeking an experienced Cybersecurity Engineer to take operational ownership of key Security Operations capabilities. This hands-on role will strengthen threat detection, incident response, monitoring, and security automation while serving as a senior escalation resource and advancing towards a more automated SOC.

The position is in‑office in Raleigh, NC, with a focus on leading IR efforts, developing playbooks, tuning EDR/XDR, and enhancing SIEM/SOAR integration for proactive