Remote Cribl Engineer for SIEM Data Pipelines

Lehigh Heavy Forge Corporation; Reston (VA); On-site; USD 87,000 - 198,000; Full time

Job summary

Booz Allen Hamilton seeks a mid-level Cribl Engineer to join the Visibility Analytics and Automation Team (VAAT). You will design, build, and optimize our enterprise data pipelines, with a focus on feeding downstream SIEM ecosystems using Cribl Stream and Cribl Edge.

Responsibilities include normalizing logs to CIM/ECS, implementing routing, masking, enrichment, and replay workflows, plus scripting in Python or Bash and infrastructure-as-code with Ansible or Terraform.

Qualifications

• 3+ years of IT experience focused on logging, observability or SIEM engineering.
• Experience operating data pipelines with Cribl Stream or Cribl Edge in production.
• Experience administering enterprise SIEM environments.
• Knowledge of log forwarding, indexing, data collection, and ingestion-time parsing.
• Must obtain TS/SCI clearance; willingness to take a polygraph.

Responsibilities

• Build, maintain, and optimize high-throughput data pipelines with Cribl Stream/Edge.
• Normalize logs to CIM/ECS before routing to downstream SIEM platforms.
• Implement routing, masking, enrichment, and replay workflows with Cribl JS and Regex.
• Monitor data flow health, troubleshoot bottlenecks, and manage worker topology.
• Automate deployment with Python/Bash and IaC tools such as Ansible or Terraform.
• Maintain technical runbooks and documentation for observability infra.

Skills

Cribl Stream/Cribl Edge

SIEM engineering

Logging/Observability

Data pipelines

TS/SCI clearance

DoD 8570 IAT Level III

DoD CSSP-IS Certification readiness

Python scripting

Bash scripting

Linux/Unix administration

Education

Bachelor's degree

Associate's degree

Master's degree

HS diploma or GED

Tools

Ansible

Terraform

JavaScript (Cribl)

Job description

Booz Allen Hamilton seeks a mid-level Cribl Engineer to join the Visibility Analytics and Automation Team (VAAT). You will design, build, and optimize our enterprise data pipelines, with a focus on feeding downstream SIEM ecosystems using Cribl Stream and Cribl Edge.

Responsibilities include normalizing logs to CIM/ECS, implementing routing, masking, enrichment, and replay workflows, plus scripting in Python or Bash and infrastructure-as-code with Ansible or Terraform.