Cyber Security Engineer

Overview

We are looking for a seasoned expert to lead crucial security operations tasks. This position involves direct oversight to enhance capabilities in threat detection, incident response, monitoring, and security automation. The role acts as a senior technical escalation point, refines operational processes and tools, and contributes to the development of a more automated and self-sufficient security operations center.

Please note: NO C2C, Agency Referrals or sponsorship at this time
Location: Raleigh, NC - half day Fridays
Compensation: $80,000-$120,000 annually
Benefits:

• 401K 200% match up to 4%
• Health, dental, vision ($0 options available) HSA
• Profit Sharing
• Tuition Assistance

Responsibilities

• Serve as the main escalation point for incident response efforts, providing technical guidance and mentorship to team members while managing on-call schedules and incident coverage.
• Develop, update, and refine incident response procedures, playbooks, and escalation paths.
• Lead investigations, containment, remediation, recovery, and post-incident analysis as a senior technical resource.
• Advance the security operations program towards increased automation and independence through orchestration, analytics, AI-driven workflows, and continuous process improvement.
• Manage and optimize endpoint detection and response technologies, including policy management, detection tuning, integrations, and maintaining operational health.
• Enhance security event collection and monitoring by integrating data sources into the SIEM, validating telemetry, and developing correlation and detection logic.
• Create and implement automation for alert enrichment, triage, investigation, containment, response, and reporting to improve consistency and reduce manual workload or alert fatigue.
• Conduct proactive threat hunting across various security domains, such as endpoint, identity, email, network, and cloud, to identify suspicious activities.
• Collaborate with internal teams and external partners to enhance detection coverage, coordinate incident response, and translate operational findings into actionable security improvements.
• Participate in tabletop exercises and simulations to evaluate and boost incident response readiness.
• Prepare clear documentation, metrics, and reports for incidents that communicate findings, actions taken, risks, and lessons learned to both technical and non-technical stakeholders.

Qualifications

• Bachelor's degree in information security, cybersecurity, computer science, or a related field, or equivalent practical experience.
• Professional certifications such as GCIH, GCFA, OSIR, CISSP, or another relevant security certification.
• Five years of practical experience in security operations, incident response, security engineering, threat detection, or a similar role within an enterprise environment.
• Proven experience in investigating and responding to security incidents across endpoint, identity, email, network, or cloud environments.
• Strong experience in managing and optimizing enterprise EDR or XDR technologies, including detection tuning, policy management, and response actions.
• Experience with SIEM architecture and operations, including log source integration, event collection, data validation, query development, correlation, and detection engineering.
• Experience in developing and maintaining incident response playbooks, procedures, and escalation workflows.
• Experience with security orchestration, automation, and response (SOAR), scripting, APIs, or workflow automation.
• Experience in performing threat hunting and translating findings into improved detections, controls, or response processes.
• Excellent analytical and problem-solving skills, with the ability to make sound decisions during high-pressure incidents.
• Strong written and verbal communication skills, with the ability to convey technical findings, risk, and recommended actions to technical and non-technical stakeholders.

Desired Skills

• Advanced understanding of incident response methodologies, digital investigation techniques, and frameworks such as NIST and MITRE ATT&CK.
• Experience with Microsoft security technologies and enterprise EDR/XDR, SIEM, SOAR, and email security platforms.
• Proficiency with a scripting or automation language and experience integrating security tools through APIs.
• Familiarity with AI-assisted security operations, autonomous SOC concepts, or automated investigation and response.
• Experience creating operational metrics, dashboards, and reporting that demonstrate detection and response effectiveness.

Applicants must be legally authorized to work in the U.S. without employer sponsorship.