Cribl Engineer: SIEM Data Pipeline & Observability

Booz Allen Hamilton; Riverdale Park (MD); On-site; USD 87,000 - 198,000; Full time

Job summary

Booz Allen Hamilton in the United States seeks a mid-level Cribl Engineer to join the Visibility Analytics and Automation Team. You will design, build, and maintain Cribl pipelines to route, mask, and transform logs, normalizing sources to CIM/ECS before sending data to downstream SIEMs and analytics tools.

The role requires 3+ years in IT logging/observability, 2+ years with Cribl Stream/Edge in production, and TS/SCI clearance.

Qualifications

• 3+ years of IT experience in logging, observability or SIEM engineering.
• 2+ years operating data pipelines with Cribl Stream or Cribl Edge in production.
• Experience administering or engineering enterprise SIEM environments.
• Knowledge of log forwarding, indexing, and ingestion-time parsing.
• Ability to obtain DoD 8570 IAT Level III certification within 60 days.
• Ability to obtain CSSP-IS certification within 30 days.
• Cribl certifications such as CCOE are preferred.

Responsibilities

• Build, maintain, and optimize Cribl pipelines for routing, masking, and transformation.
• Normalize logs to CIM/ECS schemas before routing to SIEMs and analytics tools.
• Implement routing logic, data enrichment, and replay workflows with JavaScript and Regex.
• Monitor system health, manage worker topology, and troubleshoot bottlenecks.
• Automate deployment and configuration with Python, Bash, Ansible, or Terraform.
• Maintain thorough technical documentation and runbooks for observability infra.

Skills

Logging

Observability

SIEM engineering

Data pipelines

Regex

Education

HS diploma or GED

Associate's degree

Bachelor's degree

Master's degree

Tools

Cribl Stream

Cribl Edge

JavaScript

Regex

Python

Bash

Ansible

Terraform

Job description

Booz Allen Hamilton in the United States seeks a mid-level Cribl Engineer to join the Visibility Analytics and Automation Team. You will design, build, and maintain Cribl pipelines to route, mask, and transform logs, normalizing sources to CIM/ECS before sending data to downstream SIEMs and analytics tools.

The role requires 3+ years in IT logging/observability, 2+ years with Cribl Stream/Edge in production, and TS/SCI clearance.