Cribl Engineer: Build High-Throughput Data Pipelines for SIEM

Booz Allen Hamilton; Washington (District of Columbia); On-site; USD 87,000 - 198,000; Full time

Job summary

Booz Allen Hamilton is seeking a mid-level Cribl Engineer to join the Visibility Analytics and Automation Team. You will design and maintain routing, filtering, and transformation logic using Cribl Stream and Cribl Edge to support our SIEM ecosystem.

The role focuses on building and optimizing enterprise data pipelines, data normalization to CIM/ECS, and improving observability infrastructure. Strong scripting and IaC skills are essential.

Qualifications

• 3+ years of IT experience focused on logging, observability, or SIEM engineering.
• 2+ years operating data pipelines with Cribl Stream or Cribl Edge in production.
• 2+ years administering or engineering enterprise SIEM environments.
• Knowledge of CIM/ECS, log forwarding, data collection, and ingestion-time parsing.
• Active TS/SCI clearance; willingness to take a polygraph.

Responsibilities

• Pipeline development using Cribl Stream/Edge to route, mask, and transform data.
• Normalize incoming log sources to CIM/ECS schemas before routing to SIEM platforms.
• Implement routing, data masking, enrichment, and replay workflows within Cribl pipelines.
• Monitor system health, optimize worker topology, and troubleshoot bottlenecks.
• Automate deployment/configuration with scripts (Python/Bash) and IaC tools (Ansible/Terraform).
• Maintain technical documentation and runbooks for observability infrastructure.

Skills

Cribl Stream

Cribl Edge

SIEM engineering

Data pipelines

Logging/Observability

Job description

Booz Allen Hamilton is seeking a mid-level Cribl Engineer to join the Visibility Analytics and Automation Team. You will design and maintain routing, filtering, and transformation logic using Cribl Stream and Cribl Edge to support our SIEM ecosystem.

The role focuses on building and optimizing enterprise data pipelines, data normalization to CIM/ECS, and improving observability infrastructure. Strong scripting and IaC skills are essential.