Cribl Engineer: SIEM & Data Pipeline Specialist

Phase2 Technology; Washington (District of Columbia); On-site; USD 87,000 - 198,000; Full time

Job summary

Booz Allen Hamilton is seeking a mid-level Cribl Engineer to design, build, and optimize enterprise data pipelines focused on feeding downstream SIEM ecosystems. You will implement routing, masking, enrichment, and transformation logic using Cribl Stream and Cribl Edge in a production environment.

The role requires 3+ years in IT with logging/observability focus, strong scripting in JavaScript and Regex, and security clearances with DoD 8570 certifications.

Qualifications

• 3+ years of experience in Information Technology, focusing on logging, observability, or SIEM engineering.
• 2+ years of experience operating and managing data pipelines with Cribl Stream or Cribl Edge in production.
• 2+ years of experience administering or engineering enterprise SIEM environments.
• Knowledge of log forwarding, indexing, data collection, search architecture, source types, and ingestion-time parsing.
• Active TS/SCI clearance; willingness to take a polygraph exam.
• Ability to obtain DoD 8570 IAT Level III Certification within 60 days of start date.
• Ability to obtain CSSP-IS Certification within 30 days of start date.
• Cribl Certification such as Cribl Certified Observability Engineer - CCOE Certification

Responsibilities

• Pipeline Development: Build, maintain, and optimize high-throughput data pipelines using Cribl Stream and Cribl Edge to ensure efficient data routing, masking, and transformation.
• Data Integration and Schema Mapping: Normalize incoming log sources to CIM and ECS before routing to downstream SIEM platforms, analytics tools, and storage.
• Engineering Support: Implement complex routing logic, data masking, enrichment, and replay workflows, using JavaScript functions and Regex patterns in Cribl pipelines.
• System Optimization: Monitor system health, manage worker topology, and troubleshoot bottlenecks or failures in the data flow.
• Automation: Use Python or Bash and IaC tools like Ansible or Terraform to automate deployment and configuration management.
• Documentation: Maintain technical documentation, runbooks, and SOPs for observability infrastructure.

Skills

Cribl Stream

Cribl Edge

Regex

JavaScript

Education

HS diploma or GED

Associate's degree

Bachelor's degree

Master's degree

Tools

Cribl Stream

Cribl Edge

JavaScript

Regex

Job description

Booz Allen Hamilton is seeking a mid-level Cribl Engineer to design, build, and optimize enterprise data pipelines focused on feeding downstream SIEM ecosystems. You will implement routing, masking, enrichment, and transformation logic using Cribl Stream and Cribl Edge in a production environment.

The role requires 3+ years in IT with logging/observability focus, strong scripting in JavaScript and Regex, and security clearances with DoD 8570 certifications.