Remote Senior Threat Detection Engineer (Detection-as-Code)

Cribl; Boston (MA); À distance; USD 140 000 - 200 000; Plein temps

Avantages offerts par ce poste

Health insurance

Dental insurance

Vision insurance

Short-term disability

Life insurance

Paid holidays

Paid time off

Fertility treatment benefit

401(k)

Equity

Résumé du poste

Cribl is seeking a senior security engineer to join Team Alpine and lead detection as code in a GitOps workflow using KQL. You will hunt threats, respond to incidents, and help improve the health of log pipelines across cloud and on‑prem environments.

You’ll work with Product Security, IT, and Legal, mentoring teammates while turning detections into durable rules and runbooks, with opportunities to shape Cribl's security posture and tooling.

Qualifications

• 5+ years in security operations with hands-on security roles.
• Experience writing and maintaining detections as code in a modern SIEM.
• Strong Python skills and Git-based workflows.
• Knowledge of KQL for detection queries.
• Familiarity with MITRE ATT&CK for coverage analysis.
• Experience investigating incidents in cloud/SaaS/identity providers.

Responsabilités

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow.
• Map detections to MITRE ATT&CK and identify coverage gaps.
• Review new community and vendor rule releases and decide adoption.
• Plan and run hypothesis-driven threat hunts across cloud, SaaS, identity, endpoint.
• Lead IR rotation, write/runbooks, and feed lessons into detections.
• Maintain data pipelines and CI/CD behind the detection program.

Connaissances

Python

KQL

Git

CI/CD

MITRE ATT&CK

Threat hunting

Incident response

Adversary emulation

Sigma rules

Cribl Stream

AI-assisted workflows

Outils

Cribl Stream

Sigma

Atomic Red Team

Caldera

Description du poste

Cribl is seeking a senior security engineer to join Team Alpine and lead detection as code in a GitOps workflow using KQL. You will hunt threats, respond to incidents, and help improve the health of log pipelines across cloud and on‑prem environments.

You’ll work with Product Security, IT, and Legal, mentoring teammates while turning detections into durable rules and runbooks, with opportunities to shape Cribl's security posture and tooling.