Remote Senior Threat Detection Engineer — Detect, Hunt, IR

Cribl; Jefferson City (MO); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health, dental, vision insurance

Paid holidays & PTO

401(k) and equity

Fertility treatment benefit

Job summary

Cribl is seeking a hands-on senior security engineer to join Team Alpine and run detection as code. You will design detections, hunt threats, and own incident response for the security stack.

You'll work with Product Security, IT, and Legal while improving log pipelines, SIEM integrations, and CI/CD automation. A strong background in Python, KQL, and MITRE ATT&CK is essential, with experience in cloud and identity providers.

Qualifications

• 5+ years in security operations with significant hands-on time in detection engineering, threat hunting, or incident response.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD.
• Strong in KQL for writing detection queries.
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling.
• Experience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers.
• Hands-on experience with log pipelines: getting data in, parsing it, and fixing it when it breaks.
• The judgment to separate a real signal from noise, and to know when to escalte.
• Clear writing for both technical and non-technical audiences: incident summaries, runbooks, detection docs.
• Uses AI as a routine part of engineering work, with concrete examples of how it has changed how you build, test, or investigate.
• Bonus: experience with Cribl Stream or other telemetry pipeline tools.
• Bonus: experience with Sigma rules, adversary emulation (Atomic Red Team, Caldera, or similar), or purple teaming.
• Bonus: experience building agentic or AI-assisted workflows for security operations.
• Bonus: certifications such as GCIH, GCDA, or equivalent experience.

Responsibilities

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow: issue, pull request, unit and back-testing, then automated deployment
• Map detections to MITRE ATT&CK, find coverage gaps, and decide where to invest next based on our threat model
• Review new community and vendor rule releases, such as Sigma, and decide what to adopt, adapt, or skip
• Cut alert noise by tuning, retiring rules that no longer earn their place, and tracking detection quality metrics
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate infrastructure telemetry
• Use adversary emulation to generate test events for detections that have nothing to fire on yet
• Turn hunt findings into durable detections, documentation, and backlog items
• Take part in IR rotation: triage, scope, contain, and investigate security incidents from first alert to closure
• Run retrospectives and turn the lessons into new detections, playbook updates, and fixes to visibility gaps
• Write and maintain runbooks so others on the team can respond consistently
• Assist in ownership of the health of security log flow: onboard new sources, maintain parsing and normalization, and monitor for dropped, delayed, or malformed data
• Assist and Build and maintain data pipelines with Cribl Stream to route, enrich, and reduce telemetry before it reaches the SIEM
• Maintain the CI/CD and automation behind the detection program, including GitHub Actions, SIEM API integrations, and AI-assisted gap analysis and PR review
• Work independently, and design the processes, standards, and tools that help others work well
• Mentor teammates through code review, pairing, and clear documentation
• Work with IT, Infrastructure, Engineering, and GRC to close visibility gaps and improve detection coverage

Skills

Detection engineering

Threat hunting

Incident response

Python

KQL

MITRE ATT&CK

Git workflows

CI/CD

Log pipelines

Cribl Stream

Tools

Cribl Stream

GitHub Actions

SIEM

Cloud (AWS/GCP/Azure)

Job description

Cribl is seeking a hands-on senior security engineer to join Team Alpine and run detection as code. You will design detections, hunt threats, and own incident response for the security stack.

You'll work with Product Security, IT, and Legal while improving log pipelines, SIEM integrations, and CI/CD automation. A strong background in Python, KQL, and MITRE ATT&CK is essential, with experience in cloud and identity providers.