Remote Cribl Engineer — Data Pipelines & SIEM Expert

Phase2 Technology; Norfolk (VA); On-site; USD 87,000 - 198,000; Full time

Job summary

Booz Allen Hamilton is seeking a mid-level Cribl Engineer to join the Visibility Analytics and Automation Team (VAAT). You will build, manage, and optimize enterprise data pipelines, focusing on Cribl Stream and Cribl Edge, to feed downstream SIEM ecosystems.

You will design routing, filtering, and transformation logic, implement data masking and replay workflows, and support automation via Python/Bash and IaC tools. A TS/SCI clearance is required.

Qualifications

• 3+ years of IT experience focusing on logging, observability, or SIEM engineering.
• 2+ years operating data pipelines with Cribl Stream or Cribl Edge in production.
• 2+ years administering or engineering enterprise SIEM environments.
• Active TS/SCI clearance; willingness to take a polygraph exam.
• DoD 8570 IAT Level III certification within 60 days of start date (e.g., SecurityX, CISSP, CCNP Security).
• DoD 8570 CSSP-IS certification within 30 days of start date (e.g., CEH, CySA+, GICSP).
• Cribl Certification such as CCOE is preferred.

Responsibilities

• Pipeline Development: Build and optimize high-throughput data pipelines using Cribl Stream and Cribl Edge.
• Data Integration and Schema Mapping: Normalize sources to CIM/ECS before routing to SIEM platforms.
• Engineering Support: Implement routing logic, data masking, enrichment, and replay workflows with JavaScript in Cribl.
• System Optimization: Monitor health, manage worker topology, and troubleshoot bottlenecks.
• Automation: Use Python or Bash and IaC tools (Ansible, Terraform) for deployment/configuration.
• Documentation: Maintain runbooks and SOPs for observability infrastructure.

Skills

Cribl Stream

Cribl Edge

Python

Bash

Regex

Education

HS diploma or GED

Associate's degree

Bachelor's degree

Master's degree

Tools

Cribl Certification

Job description

Booz Allen Hamilton is seeking a mid-level Cribl Engineer to join the Visibility Analytics and Automation Team (VAAT). You will build, manage, and optimize enterprise data pipelines, focusing on Cribl Stream and Cribl Edge, to feed downstream SIEM ecosystems.

You will design routing, filtering, and transformation logic, implement data masking and replay workflows, and support automation via Python/Bash and IaC tools. A TS/SCI clearance is required.