Cybersecurity Engineer

Kimley-Horn, one of Fortune Magazine’s “100 Best Companies to Work For,” is seeking an experienced Cybersecurity Engineer to take technical ownership of key Security Operations capabilities. This hands on role will strengthen our threat detection, incident response, monitoring, and security automation capabilities. This position will serve as a senior technical escalation resource, improve operational processes and tooling, and help advance Kimley-Horn toward a more automated and autonomous SOC.

This is and in-office position.

• Lead incident response operations as the primary escalation point, providing technical guidance and mentorship to team members while managing the incident response on-call schedule and coverage
• Develop, maintain, and continuously improve incident response processes, procedures, playbooks, and escalation paths
• Serve as a senior technical escalation resource for security incidents, leading investigations, containment, remediation, recovery, and lessons‑learned activities
• Help advance the Security Operations program toward a more automated and autonomous SOC through orchestration, analytics, AI-assisted workflows, and continuous process improvement
• Administer, optimize, and advance endpoint detection and response (EDR/XDR) technologies, including policy management, detection tuning, integrations, and operational health
• Improve security event collection and monitoring within the SIEM by onboarding data sources, validating telemetry, developing correlation and detection logic.
• Design and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to increase consistency and reduce manual effort or alert fatigue
• Establish and conduct proactive threat hunting using endpoint, identity, email, network, cloud, and other security telemetry to identify suspicious activity
• Partner with internal teams and external providers to improve detection coverage, coordinate incident response, and translate operational findings into actionable security improvements
• Participate in tabletop exercises and simulations to validate and improve incident response readiness
• Prepare clear incident documentation, metrics, and reports that communicate findings, actions taken, risk, and lessons learned to technical and non-technical stakeholders

• Bachelor’s degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience
• Professional certifications such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification
• 5+ years of hands-on experience in security operations, incident response, security engineering, threat detection, or a similar role within an enterprise environment
• Demonstrated experience investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments
• Strong experience administering and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions
• Experience with SIEM architecture and operations, including log source onboarding, event collection, data validation, query development, correlation, and detection engineering
• Experience developing and maintaining incident response playbooks, procedures, and escalation workflows
• Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation
• Experience performing threat hunting and translating findings into improved detections, controls, or response processes
• Excellent analytical and problem-solving skills, with the ability to make sound decisions during high-pressure incidents
• Strong written and verbal communication skills, with the ability to convey technical…